The vulnerability is an information disclosure flaw (CWE‑200) that allows a malicious web page to retrieve data created by another origin within Google Chrome. An attacker can construct a crafted HTML page that, when opened in the browser, triggers the browser to expose cross‑origin data to the malicious page. The impact is that confidential information, such as cookies, local storage, or other sensitive data originating from a different website, can be read by an attacker, compromising privacy and potentially enabling further attacks.

Affects Google Chrome versions earlier than 157.0.8103.38. Users running any September 2026 stable channel build or earlier are vulnerable. The hot‑fixed build 157.0.8103.38 includes the patch that removes the ability for a page to access cross‑origin data. No other vendor or product is affected.

Chromium assigns a medium severity to this issue, and no EPSS score is published, implying low known exploit activity. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The likely attack vector is a malicious website or email link that opens the crafted page inside Chrome, and the attacker relies on the origin separation enforcement being bypassed. Because exploitation occurs once the user accesses the malicious page, the broader risk is limited to users of the vulnerable browser builds and requires user interaction and a pre‑patch version of Chrome.