An incorrect implementation in the WebAppInstalls component of Google Chrome allows a remote attacker to bypass the browser’s same‑origin policy by delivering a specially crafted HTML page. The vulnerability arises because the component fails to verify the presence or state of an object before using it, which is a CWE‑346 weakness. This bypass lets an attacker read or modify data from a different origin than intended, potentially exposing sensitive information or enabling further attacks within the browser context.

Chrome users running any version earlier than 150.0.7871.47 are affected. The vulnerability is confined to the browser; other system components remain unaffected.

The CVSS base score of 6.5 indicates a medium severity vulnerability, while an EPSS score of less than 1 % suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must convince a victim to load a malicious HTML page from a remote source to take advantage of the policy bypass.