A vulnerability in the V8 engine in earlier releases of Google Chrome allows an attacker to craft an HTML page that forces the browser to expose data from other origins, resulting in an information disclosure. The flaw is a classic cross‑origin data leak, which could compromise user privacy and expose sensitive information. It is cataloged as CWE‑200 and targets the browser’s ability to isolate web content.

Google Chrome versions prior to 157.0.8103.38 are affected. Any user or system running those versions is potentially vulnerable if it visits a maliciously crafted web page.

The vulnerability is reported as Medium severity by Chromium. No CVSS score is listed, and the EPSS is not available, indicating that no global exploitation trend has been identified yet. The attack likely requires a remote attacker to host a malicious web page that the victim visits, so the vector is remote via the web. Because the flaw leaks data between sites, the impact is significant for confidentiality of user data but does not grant arbitrary code execution.