The vulnerability lies in the BackgroundFetch implementation of Google Chrome, where missing authorization checks allow a remote attacker to craft a web page that can initiate background fetch requests without proper origin verification. This flaw enables the attacker to bypass normal web origin policies, potentially accessing or manipulating data on behalf of the user. The impact manifests as a compromise of the browser’s security model, allowing leakage or unauthorized modification of cross‑origin resources.

All installations of Google Chrome older than version 157.0.8103.38 are affected. The flaw exists across all supported operating systems where the browser is installed, regardless of network configuration, because the background fetch functionality is a core part of the Chrome rendering engine.

The fixed version is listed as a Medium severity issue by Chromium security. Although the EPSS score is not available and the vulnerability is not included in the CISA KEV catalog, the presence of a remote code execution vector via a crafted web page suggests a moderate likelihood of exploitation if users visit malicious sites. Attackers could leverage this flaw to perform cross‑origin requests that evade the usual same‑origin policy, potentially compromising user data. Until an update is applied, the risk remains until the flaw is patched in a future browser release.