The vulnerability in Chrome’s PrivateTokens handling allows a remote attacker to obtain sensitive information by loading a crafted HTML page. The attack results in an information leak classified as CWE‑200, and the severity is rated medium by Chromium's security assessment. The likely attack vector is a malicious web page that exploits the browser’s handling of private tokens, allowing the attacker to read data that should remain confidential.

Google Chrome is affected, specifically all versions released before 157.0.8103.38. Any installation of the browser below this version is at risk and should be updated to the patched release or a newer version.

Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the available evidence indicates that exploitation is plausible but not yet observed at scale. The medium severity rating suggests that an attacker who can serve a malicious page to a user is likely to gain confidential data without needing elevated privileges or additional system access. Mitigating this risk requires updating the browser to remove the PrivateTokens flaw or applying any mitigations provided by the vendor. Until such patch is available, the window of opportunity for adversaries remains open.