The flaw arises from insufficient enforcement of the Related‑Website‑Set policy in Google Chrome, allowing a remote attacker to craft an HTML page that causes the browser to expose data from another origin. This results in cross‑origin information disclosure. The weakness is cataloged as CWE‑693, indicating improper restriction of operations by policy.

Google Chrome versions prior to 150.0.7871.47 are affected. PCs or devices with these builds that have not applied the specified update remain vulnerable to information leakage via a crafted web page.

The CVSS score of 6.5 represents medium severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting that it has not been widely exploited. An attacker could potentially deliver a malicious page through social engineering or compromised sites, leading to leakage of sensitive cross‑origin data.