A confused deputy flaw in the DevTools component of Google Chrome before version 157.0.8103.38 enables a remote attacker, by means of social engineering, to serve a crafted HTML page that bypasses the browser’s web origin policy. Because the defect involves improper handling of privileged operations within DevTools, a compromised user can read or execute data from other origins that would normally be protected. The weakness is identified as CWE‑441, indicating the software incorrectly trusts a higher‑privileged component for actions that should be denied.

Google Chrome desktop browsers prior to version 157.0.8103.38 are affected. The issue impacts all operating systems that run the standard Chrome distribution and does not appear to be limited to any specific platform or operating mode.

The vulnerability is rated as medium severity by Chromium’s internal scoring. Exploitation requires a social‑engineering step where the user opens a malicious page in Chrome and activates DevTools. While the prevalence of exploitation is not quantified—EPSS is not available—and the vulnerability is not listed in CISA’s KEV catalog, the potential for an attacker to read or execute cross‑origin content remains present. The risk to confidentiality and integrity is contingent upon the attacker’s ability to lure a user into engaging with DevTools on an untrusted site.