An insufficiently validated input vector in the Network module of Google Chrome allows a remote attacker, once having compromised the renderer process, to bypass the same‑origin policy. The flaw is a classic input validation weakness that can be exploited to gain unauthorized access to web page resources that would normally be restricted by browser security boundaries.

Victims are users running Google Chrome prior to version 149.0.7827.53. The affected component is the renderer process within the browser. Any Chrome installation on which the renderer has been compromised can be impacted.

The reported Chromium security severity is low, and there is no EPSS score or KEV listing. A successful exploitation requires an attacker to have already gained control of the renderer process, which is a non‑trivial prerequisite. Without this compromise, the flaw is not exploitable, so the risk remains low to medium depending on the likelihood of renderer compromise in the environment.