Technical impact
The vulnerability results from an inappropriate implementation of the Permissions API in Google Chrome, which enables a remote attacker to access or leak data from a different origin via a specially crafted HTML page. This leads to the disclosure of confidential information that should have been protected by the browser’s same‑origin policy. The weakness aligns with CWE‑362, incorrect synchronization, indicating a race condition that can be exploited to bypass policy enforcement, and also with CWE‑940, which signals a failure to enforce resource ownership.
Affected Systems
Google Chrome versions earlier than 149.0.7827.53 are affected. Users running those builds are susceptible to the data leakage unless the browser is upgraded.
Risk and Exploitability
The vulnerability has a CVSS score of 4.3, indicating low severity, and EPSS score < 1%. It is not listed in the CISA KEV catalog. The attack likely requires the victim to visit a malicious web page that contains crafted HTML and the Permissions API; the exploit is remote and does not require local privileges. Because of the low severity and lack of public exploit evidence, the overall risk remains moderate, but any exposure of cross‑origin data can be consequential in sensitive contexts.
Debian DSA