Observable discrepancies in the handling of Media elements in Google Chrome allowed a remote attacker to leak cross‑origin data through a crafted HTML page. The flaw facilitates disclosure of confidential information from another origin, compromising the confidentiality of user data. This vulnerability is categorized as CWE‑203, reflecting a loss of confidentiality via an information leakage weakness.

The affected product is Google Chrome, specifically versions prior to 157.0.8103.38. Users of older releases on any platform are vulnerable. No other vendors or products are listed.

The vulnerability is triggered by serving a malicious HTML page that exploits the media rendering logic. An attacker can control the page content and has no need for additional privileges. The CVSS score is medium, and the EPSS score is not available, suggesting no publicly reported exploitation yet. Since the issue is not listed in the CISA KEV catalog, it is not confirmed as a known exploited vulnerability, but the medium severity and remote attack vector warrant mitigations.