Google Chrome does not enforce policy on CSS requests that can be exploited by a remote attacker to read cross‑origin data from a crafted HTML page. The flaw allows an attacker to read, and therefore disclose, content that should remain private to the target origin. This is an information‑disclosure vulnerability and is classified as CWE‑200.

The vulnerability affects Google Chrome versions prior to 149.0.7827.53. Users running any earlier build of Chrome are susceptible until they upgrade to the fixed release or later.

The CVE is marked as low severity by Chromium; no EPSS score is available and it is not listed in CISA’s KEV catalog. The attack requires a user to visit a malicious web page that serves specially crafted CSS, which can then be used by the attacker’s code to extract data from a different origin. Though the likelihood of exploitation appears modest, the consequence is a straightforward leak of sensitive information.