An authorization flaw in the Cross‑Origin Resource Sharing (CORS) implementation of Google Chrome allowed a remote attacker to breach the web origin policy. The vulnerability stems from an improper check of the requesting origin, enabling a malicious web page crafted by the attacker to read data that should have been protected by same‑origin rules. As a result, an attacker could exfiltrate data from a victim’s browser session without the user’s knowledge, representing a cross‑origin data leakage. This weakness is classified as incorrect authorization (CWE‑863).

Google Chrome users running any version older than 157.0.8103.38 are vulnerable. The flaw affects the desktop stable channel of Chrome, and applies to all platforms where the browser is installed.

The risk is moderate because exploitation requires the victim to visit a malicious HTML page, implying a social‑engineering attack vector. The Chromium severity is listed as low, and the EPSS score is not available. The vulnerability is not currently in the CISA KEV catalog. An attacker would gain unauthorized cross‑origin access and could read data from other origins, but cannot execute arbitrary code or manipulate the browser state outside the affected origins.