Improper resource control in the WebCodecs component of Google Chrome allows a maliciously crafted HTML page to bypass the browser’s web origin policy. This flaw turns inter‑origin resource requests into same‑origin requests, giving a remote attacker the ability to read or exfiltrate data protected by cross‑origin restrictions. The weakness stems from inadequate access control, corresponding to CWE‑913.

All users of Google Chrome installed before version 157.0.8103.38 are affected, regardless of platform. The vulnerability applies to the stable release channel and any derivative browsers that include the same WebCodecs implementation.

The Chromium advisories list a medium severity rating, but no CVSS score is publicly available, so the exact quantitative risk cannot be determined from this data. The EPSS score is not provided, and the vulnerability is not catalogued in CISA’s KEV list. The attack vector is remote: an attacker merely needs to host a malicious HTML page that is opened by a victim in Chrome. Because the flaw is exploitable through a typical browsing action, the practical risk for users who visit untrusted websites is moderate to high, especially if a browser update cannot be applied quickly.