An inappropriate implementation of the FedCM feature in Google Chrome allows a remote attacker to bypass the browser's same‑origin policy using a crafted HTML page. The flaw, classified as CWE‑346, permits cross‑origin data access that would normally be prevented by Chromium security, potentially allowing the attacker to read or manipulate data from another origin.

Google Chrome versions earlier than 150.0.7871.47 are affected. The flaw exists in the FedCM implementation shipped with these releases and has been addressed in the 150.0.7871.47 update and later.

The CVSS score of 4.3 indicates a low severity factor. The exploitability of this vulnerability is low. No known exploits and the EPSS score is < 1%, indicating a very low chance of real exploitation. The likely attack vector is a client‑side drive‑by scenario, delivering a malicious webpage to the target system and exploiting the FedCM flaw. The vulnerability is not listed in the CISA KEV catalog. The flaw permits circumvention of the same‑origin policy. Overall risk remains low, but patching is recommended to eliminate the possibility of future exploitation.