An incomplete cleanup in Chrome DevTools allowed a remote attacker to bypass the web origin policy through a crafted HTML page. The flaw could let an attacker read or write data from cross‑origin contexts that should have been blocked, potentially compromising user data integrity, confidentiality, and the reliable isolation of web content. The vulnerability is classified as low severity by Chromium, reflecting the limited ease of exploitation compared to higher‑impact flaws but still representing a valid attack channel. The attack vector is inferred to involve a malicious page loaded in a user’s browser, which triggers the DevTools cleanup issue; no additional privilege or local code execution is required.

Google Chrome desktop versions earlier than 157.0.8103.38 are affected. Users running any revision of Chrome before this patch are at risk, regardless of operating system.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating low currently observed exploitation probability. The CVSS rating is low, reflecting the limited impact and difficulty of exploitation. The remote attacker requires only a crafted webpage and a user who visits it in an affected Chrome installation. Despite the low risk, the violation of the origin policy remains a serious concern for web privacy and data isolation.