The vulnerability is an improper access control flaw in Google Chrome’s DevTools caused by incorrect reference resolution. A remote attacker can leverage social engineering and a crafted HTML page to bypass the web origin policy via DevTools, allowing them to read or leak data to which the user has access. The issue is identified as CWE‑706 and is rated as Medium by Chromium security.

Google Chrome versions earlier than 156.0.8078.47 are affected. The flaw exists in the desktop release of Chrome and is specifically linked to DevTools functionality. Users running any Chrome build below that version are at risk if they allow arbitrary HTML content to load and provide untrusted content to DevTools.

The CVSS score of 6.5 is classified as Medium, indicating a moderate level of risk. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that there are no confirmed, widespread exploits yet. The likely attack vector is a remotely crafted HTML page that a victim is tricked into opening; this page exploits the missing access control in DevTools to read the victim’s data. Because the flaw could allow information disclosure, it is important to consider the potential damage to confidentiality if an attacker can view browsing data, cookies, or local storage items.