A crafted HTML page can trigger an information leakage in the Core component of Google Chrome versions before 157.0.8103.38, allowing a remote attacker to read cross‑origin data. The flaw is categorized as CWE‑200, which indicates that private information is being exposed to an unauthorized party. The consequence is that sensitive data, such as credentials or private documents, could be disclosed if the attacker can load a malicious page in the victim’s browser.

Users running Google Chrome on desktop with a version older than 157.0.8103.38 are affected. The vulnerability applies to the stable channel update for desktop browsers, and all preceding releases that have not yet been patched by this update.

The advisory rates the issue as medium severity and there is no publicly available EPSS score. The vulnerability is listed as not being in CISA’s KEV catalog. Attackers can exploit the flaw remotely by convincing a victim to view a specially crafted HTML page, which can be served from an attacker‑controlled website or via phishing. Because the bug is a straightforward cross‑origin leak, no special prerequisites beyond user interaction with the malicious content are required.