An improper handling of network traffic in Google Chrome before 150.0.7871.47 allowed an attacker positioned on a privileged network to inject or modify data in transit, bypassing the browser’s Content Security Policy. This weakness permits the loading or execution of scripts and resources that would normally be blocked, potentially allowing malicious code to run in the context of a Web page and threaten information integrity or enable further exploitation. This vulnerability corresponds to CWE‑693.

Google Chrome versions earlier than 150.0.7871.47 are affected. The CVE does not specify operating system restrictions.

The vulnerability has a CVSS score of 6.5, indicating medium severity. Its EPSS score is less than 1%, pointing to a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Exploitation requires an attacker with privileged control over network traffic, limiting it to environments where an adversary can intercept or inject data. While the potential impact of bypassing CSP—allowing script injection or loading of unauthorized content—is significant, the realistic risk is moderate due to the low exploitability likelihood and the necessity of a privileged network position.