A discrepancy in the CORS handling of Google Chrome versions prior to 157.0.8103.38 permitted a remote entity to craft an HTML page that triggered the browser to expose cross‑origin data it should have denied. The flaw allows the attacker to read otherwise protected information, though it does not provide code execution or privilege escalation on the host. The weakness is classified as CWE‑203, an incorrect page ownership check.

Google Chrome browsers with release numbers earlier than 157.0.8103.38 are affected. No other vendors or product lines are mentioned, so the impact is confined to the specified Chrome releases.

EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The official Chromium severity is labeled Low, indicating a modest impact on confidentiality. Because the attack requires delivery of a crafted page to the victim, the attacker must entice the user to visit or otherwise load the malicious content. No evidence of widespread exploitation exists, but the flaw remains a valid attack surface for adversaries who can lure users into executing the crafted page.