The vulnerability in Google Chrome arises from an inappropriate CSS implementation that permits a remote attacker to leak cross‑origin data through a specially crafted HTML page. This weakness is classified as CWE‑200, an information‑exposure issue, and can lead to cross‑origin information disclosure that compromises the confidentiality of normally protected data.

Google Chrome is the affected product. The CNA has not published specific version ranges; the description indicates that builds prior to 150.0.7871.47 may be vulnerable, but version information is not officially documented. Users should consider any Chrome release older than 150.0.7871.47 to be potentially at risk until a patch is released.

According to the CVSS score of 6.5, the vulnerability falls into the medium‑severity range. The EPSS score of less than 1% indicates a low historical exploitation likelihood, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that a malicious webpage served to a victim’s browser could trigger the leakage, making the attack vector likely a remote attacker controlling an HTML page that prompts the browser to process the vulnerable CSS. The impact constitutes a confidentiality breach of cross‑origin data.