A crafted HTML page enables a remote attacker to bypass the same‑origin policy within Chrome DevTools. This flaw, present in all Chrome releases prior to 149.0.7827.115, allows an attacker to read or manipulate data from privileged origins, potentially leading to theft of sensitive information, unauthorized actions, or further exploitation. The weakness is rooted in insufficient policy enforcement inside DevTools, a security control intended to prevent cross‑origin access.

All users of Google Chrome browsers on the stable channel prior to version 149.0.7827.115 are affected. Any installation that has not applied the latest update contains the vulnerability.

The vulnerability is classified as high severity by Chromium. Although an EPSS score is not available, the absence of a CISA KEV listing suggests it has not been publicly exploited yet, yet the remote nature of the exploit and the impact warrant caution. The likely attack vector is a user visiting a maliciously crafted web page that instructs the browser to use DevTools features. No pre‑conditions beyond the browser are required, making this a straightforward remote exploitation scenario.