The flaw is a missing authorization check in Chrome’s PerformanceAPIs, allowing a remote attacker to craft an HTML page that reads data normally limited to the page’s origin. This permits the exfiltration of sensitive information from the victim’s browser session. The weakness corresponds to CWE‑862, missing authorization.

Google Chrome builds before 157.0.8103.38 on any supported operating system are impacted. Any user who can load arbitrary web pages using those versions may fall victim to the data leak.

The vulnerability can be exploited remotely by delivering a malicious HTML page to a user’s browser. While the issue is labeled as a Medium severity by Chromium, the potential for widespread exploitation remains because it does not require local code execution or elevated privileges. The EPSS score is not available and the CVE is not listed in CISA KEV, indicating no known wide‑scale exploitation yet, but the risk warrants timely remediation.