The vulnerability arises from insufficient validation of untrusted input by Google Chrome before version 149.0.7827.155. An attacker who has already compromised the renderer process can deliver a specially crafted HTML page that tricks Chrome into violating the same‑origin policy. The denial of the origin barrier allows the attacker to read or manipulate data belonging to other web origins, which can lead to data theft or unauthorized actions on behalf of the user. The underlying weaknesses include an input validation flaw (CWE‑20) and a trust boundary bypass (CWE‑346).

The flaw affects Google Chrome versions earlier than 149.0.7827.155 on desktop platforms. Users running these releases are susceptible until the vendor releases a patch that includes proper input validation checks.

The CVSS score of 4.2 classifies the bug as moderate, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. Although the vulnerability is not listed in the CISA KEV catalog, the Chromium project has marked it as a high‑severity issue. Exploitation requires that the attacker first compromise the renderer process, which is typically achieved through a preceding vulnerability or user interaction. Once that condition is met, the attacker can manipulate the browser to bypass same‑origin restrictions using a crafted HTML payload.