An insufficient validation in Google Chrome’s Network component allowed a compromised renderer process to read data across origin boundaries. The flaw exploits a lack of proper input checks (CWE‑20), enabling data leakage beyond the same‑origin policy. This can expose only the data the compromised renderer has access to, potentially leaking sensitive cross‑origin information.

Every desktop build of Google Chrome released prior to version 150.0.7871.47 is affected. Users on any channel—stable, beta, dev, or canary—who have not yet updated are at risk.

Exploitation requires a prior compromise of the renderer process, a sandboxed component of the browser. The CVSS score of 6.5 indicates medium severity, the EPSS score is less than 1 %, and it is not listed in CISA’s KEV catalog. The likely attack vector is a crafted page that the compromised renderer processes to leak cross‑origin data, but this is inferred because the description does not specify the exact method.