A remote attacker can craft a malicious HTML page that, when opened by a user in Google Chrome before version 157.0.8103.38, causes the browser’s network stack to dispense data with insufficient origin checks. The flaw permits the attacker to read cross‑origin content that should be opaque, effectively leaking confidential or private information. This weakness fulfills CWE‑200, an information‑disclosure vulnerability.

Google Chrome browsers earlier than 157.0.8103.38 are impacted, regardless of the operating system on which they run. Any user who has not updated to the patched stable channel version is potentially vulnerable.

The CVSS base score is Medium, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the victim opens a crafted page, so no additional privileges or network compromise are needed. EPSS data is not available, making the likelihood of widespread exploitation uncertain, but the absence of KEV entries suggests no large‑scale attacks have yet been observed.