The vulnerability is an insufficient validation of untrusted input in the Chrome WebUI component for versions before 150.0.7871.47, representing a CWE‑20 input validation flaw. A malicious payload delivered over the network can be treated as trusted by the browser, allowing an attacker to read data that normally would be protected by cross‑origin restrictions. This leads to a confidentiality compromise where sensitive information can be exfiltrated.

Any installation of Google Chrome running a build older than 150.0.7871.47 is affected. Users whose browsers process WebUI traffic from untrusted sources are at risk of inadvertent cross‑origin data leakage.

The flaw carries a medium severity rating (CVSS 6.5) and an exploitation probability of less than 1% according to EPSS, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the issue remotely by sending crafted network traffic to the WebUI endpoint; the CVE data does not mention any user interaction, so it is inferred that none is required. The overall risk is moderate, though the potential impact on data confidentiality warrants prompt attention.