This vulnerability involves incorrect authorization handling in the Proxy Auth protocol of Google Chrome prior to 157.0.8103.38, allowing an attacker on the same network segment to craft traffic that bypasses authorization checks and retrieve sensitive information. The weakness is identified as CWE-863, Unauthorized Access, and can lead to the recovery of credentials, session tokens or other confidential data that the browser treats as secure.

All users running Google Chrome versions earlier than 157.0.8103.38 are affected. The problem exists across all Chrome builds (stable, beta, dev) on all supported platforms until the indicated version.

Chromium reports the vulnerability as medium severity. No EPSS score is available, so the likelihood of exploitation remains uncertain. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker on a nearby network that can send crafted HTTP proxy authentication traffic to the victim’s browser, typically the local LAN. The risk is mitigated by network segmentation or disabling proxy use on untrusted local connections.