The vulnerability is an improper input validation bug in the network component of Google Chrome that allows a remote attacker to craft a malicious HTML page and bypass the browser’s same‑origin policy. This flaw could let an attacker read restricted data from other sites, inject rogue content, or perform actions on behalf of the user. The weakness is identified as CWE‑20, reflecting the failure to validate input before processing.

All installations of Google Chrome with a version earlier than 157.0.8103.38 are affected. The problem is in the network stack, so it applies to all platforms that run Chrome (Windows, macOS, Linux, Android, iOS) as long as the software has not been updated to the patched release.

The CVSS and EPSS information is not available and the issue is not listed in CISA’s KEV catalog, indicating a low overall risk rating. The attack requires a remote attacker to supply a crafted HTML page, so it is a remote web‑based vector. The vulnerability is publicly known through Google’s release notes and Chromium issue tracker, but no active exploits have been reported. The patch is already released in version 157.0.8103.38, and applying it removes the flaw and restores the browser’s origin enforcement.