A confused deputy flaw in Chrome’s BackgroundFetch allows a remote attacker to craft an HTML page that tricks the browser into performing background fetches with higher privileges, potentially bypassing the web origin policy and accessing data across origins. The attack does not grant arbitrary code execution, but it can lead to confidentiality violations by reading or modifying information from other web origins. The vulnerability is identified as CWE-441, indicating improper treatment of delegated privileges.

All desktop versions of Google Chrome before 157.0.8103.38 are affected, regardless of operating system. Users on the stable channel who have not yet upgraded to the patched release are at risk. The issue applies to both regular browsing sessions and background fetch operations triggered by web applications. No additional patches are required beyond the 157.0.8103.38 update to remove the vulnerability.

The CVSS severity is medium and no EPSS score is available, indicating a moderate but nonzero exploitation risk. The vulnerability is not listed in CISA KEV, so it has not yet been documented as a widely used exploit. The likely attack vector is remote delivery of a crafted HTML page, inferred from the description that a malicious page can trigger the flaw. Exploitation requires victim interaction (loading the page) and permits the attacker to bypass same‑origin restrictions, potentially read or write cross‑origin resources.