The vulnerability is an incorrect authorization check in Chrome DevTools that allows a remote attacker to bypass the web origin policy. By delivering a crafted HTML page to a user and using social engineering tactics, the attacker can trick the user into loading the page, which then uses DevTools functionality to read or write data across origin boundaries. This could lead to confidential data disclosure or modification of content in a victim’s browser context.

Google Chrome browsers older than version 157.0.8103.38 are affected. The flaw exists in the DevTools component used by all channel builds prior to the specified release.

The issue is categorized as medium severity by Chromium. No EPSS score is available and it is not listed in the CISA KEV catalog, suggesting low to moderate exploitation likelihood. However, exploiting the flaw requires social engineering to prompt the user to load a malicious page, which limits attack surface but still presents a non‑negligible risk due to potential cross‑origin data exposure.