This vulnerability arises from a missing authorization check in the V8 JavaScript engine used by Google Chrome up to version 157.0.8103.38. A crafted HTML page can exploit the flaw to circumvent the browser’s web origin policy, allowing an attacker to read or manipulate data from other origins. The weakness corresponds to CWE‑862, missing authorization.

The affected product is Google Chrome on all platforms that use the V8 engine. Any installations running a V8 version prior to 157.0.8103.38 are impacted.

The EPSS score is not available; the flaw is rated low severity by Chromium. The exploit requires an attacker to deliver a malicious HTML page to a user; there is no remote code execution or network exploitation from outside the browser. The vulnerability is not listed in CISA KEV, but once a user loads a crafted page it can bypass the same‑origin restriction and access protected data. The lack of an authorization check indicates the exploit is feasible with minimal prerequisites, making the risk moderate for unpatched systems.