Improper input validation in WebPackaging within Google Chrome allows a remote attacker to craft network traffic that bypasses the browser's web origin policy. By taking advantage of missing checks, the attacker can cause the browser to treat a resource as belonging to a different origin, potentially enabling cross‑origin data access or execution of privileged scripts. The flaw is classified as CWE‑20 and is rated a medium severity by Chromium.

Affected systems are Google Chrome browsers up to, but not including, version 157.0.8103.38. Users running any earlier stable channel build are vulnerable. The vulnerability applies to all platforms that ship with Chrome's WebPackaging component.

The exploit requires only crafted inbound network traffic and can be performed from a remote host with no user interaction. Because the flaw is a classic input validation failure, it is likely to be automated by attackers. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that it has not yet been observed in the wild. Nevertheless, the severity is medium and the attack vector is remote, so the overall risk is significant for unpatched systems.