The vulnerability is an information‑leak issue in the BackgroundFetch API of Google Chrome. A crafted HTML page can trigger a background fetch request that allows an attacker to read data from other origins, exposing sensitive cross‑origin information. The weakness is identified as CWE‑200 and is rated Medium by Chromium security severity.

Google Chrome versions prior to 157.0.8103.38 are affected. The issue applies to the Desktop stable channel of Chrome and any deployment that has not received the 157.0.8103.38 patch, regardless of platform. All users running affected Chrome versions may be exposed.

The CVSS score is Medium; EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a malicious or compromised web page that the user visits, which then exploits the BackgroundFetch API to retrieve cross‑origin data. While the attack requires user interaction or a page the user loads, the impact on confidentiality is significant, and the lack of exploitation data makes it prudent to treat the risk as notable.