The vulnerability is an incorrect authorization validation in the Chrome Core component that allows a remote attacker to bypass the web origin policy. This authorization bypass (CWE‑863) can be triggered by a specially crafted HTML page, enabling the attacker to access or manipulate data across origin boundaries, potentially leading to data theft or malicious code execution.

Affected consumers are users of Google Chrome versions older than 157.0.8103.38. The issue applies to the Chrome stable channel and any installations that have not yet received the 157.0.8103.38 update.

The EPSS score is not available, but the vulnerability is rated Medium by Chromium security. It is not currently listed in the CISA KEV catalog, indicating no widespread exploitation reports yet. The likely attack vector is a remote attacker hosting a malicious web page that, when opened by the victim in an affected Chrome browser, triggers the origin policy bypass. Successful exploitation would require the victim to load the crafted page, so risk is inherent to web browsing activity.