An inappropriate CSS implementation in Google Chrome versions earlier than 150.0.7871.47 permits a remote attacker to create a crafted HTML page that bypasses the browser’s same origin policy. This flaw can allow the attacker to read or manipulate data belonging to other origins, effectively enabling cross‑origin data exfiltration or manipulation. The weakness is rooted in improper validation of CSS constructs, leading to an unintended policy bypass that undermines the confidentiality and integrity of web content.

Google Chrome users running the affected browser version are impacted. Affected versions are all releases prior to 150.0.7871.47 on desktop platforms, as reported by the vendor’s release notes and issue tracker.

The vulnerability has a high severity rating in Chromium’s internal assessment. No EPSS score is the. Exploitation requires the attacker to host a malicious web page and lure a victim to visit it; the attack vector is remote via the internet. Because the flaw directly bypasses same origin restrictions, once exploited an attacker can read sensitive data from cross‑origin resources. The lack of a public exploit suggests moderate to low likelihood of immediate exploitation, yet the severity warrants timely remediation.