The vulnerability arises from insufficient enforcement of the Related-Website-Set policy in Chromium, allowing a malicious page to read data from a different origin. The flaw can be triggered with a crafted HTML page and results in unauthorized disclosure of cross‑origin information. The flaw does not provide code execution or privilege escalation, but exposes confidential data. This issue carries a low security severity rating in Chromium.

The defect affects Google Chrome browsers that are earlier than version 150.0.7871.47. Internet users running these older builds are susceptible to the cross‑origin leak. Modern stable releases deployed after that milestone implement proper policy checks and eliminate the vulnerability. In addition, any instance of Chrome that sideloads or runs older code paths without patching remains at risk.

The weakness can be exploited remotely by hosting a site that serves a specially crafted page. An attacker needs only to lure a user into opening the page, which can be achieved through social engineering or compromised content. The EPSS score is not available, but the CVSS is low, and the vulnerability is not listed in the CISA KEV catalog, indicating a limited threat surface. Nevertheless, as the flaw allows data leakage, its impact on confidentiality warrants prompt remediation.