A flaw in the implementation of DeviceBoundSessionCredentials in Google Chrome releases before 149.0.7827.197 allows a remote attacker to craft an HTML page that can bypass the browser’s same‑origin security boundary. This vulnerability enables the attacker to read or modify data that should be confined to a single origin, potentially exposing sensitive user data, session cookies, or other credentials. The nature of the weakness is a failure to enforce origin isolation, which is the basis of web confidentiality and integrity. Based on the description, the impact is a cross‑origin data leak or manipulation by the malicious page, affecting any user who visits the crafted content.

All users running Google Chrome prior to version 149.0.7827.197 are affected. The issue applies to the stable channel and is mitigated in later releases, including the new build referenced in the Google release notes.

Chromium labels the severity as High. There is no EPSS score available, and the vulnerability is not listed in CISA KEV, indicating it has not yet been observed in the wild, but the inherent risk is significant because a same‑origin policy bypass can deliver arbitrary cross‑site data access. The likely attack vector is a remote attacker hosting a malicious web page that a victim visits; no local setup or user‑initiated code execution is required.