The vulnerability is an input‑validation weakness in Chrome’s StorageAccessAPI that allows a compromised renderer process to expose cross‑origin data when a specially crafted HTML page is loaded. Because the API does not enforce proper policy checks in versions prior to 150.0.7871.47, an attacker who has already managed to subvert a renderer can read data belonging to other origins. The result is unauthorized retrieval of potentially sensitive information, a clear compromise of confidentiality for the affected user. The weakness is classified as CWE‑20.

Google Chrome installations with a version older than 150.0.7871.47 are affected. All older releases lack the policy enforcement that mitigates cross‑origin data leakage. Newer releases have the patch applied and are not vulnerable. The flaw is tied exclusively to the Chrome renderer component within those older versions.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS of less than 1 % suggests a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires an initial compromise of the renderer process, which typically limits the attack surface but still poses a risk to users who run unmanaged or malicious code that can target Chrome’s rendering engine. The primary attack vector is a crafted HTML page executed by the compromised renderer, allowing the attacker to trigger the StorageAccessAPI and read cross‑origin data.