The vulnerability is insufficient policy enforcement in the StorageAccessAPI, allowing an attacker to access and leak cross‑origin data from a crafted HTML page. An attacker can remotely trigger the flaw by hosting a malicious page that the victim visits, bypassing the intended isolation between origins. The defect results in disclosure of sensitive data to a third party, classified as an information leak.

Google Chrome browsers prior to version 150.0.7871.47 are affected. Any user or system running an older Chrome build exposed to spoofed web content can be impacted.

Risk: The vulnerability is exploitable over the network through a normal web request (remote attacker via crafted HTML). No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, indicating low current exploitation activity. The Chromium security severity is Low, and the potential impact is limited to disclosure of cross‑origin data. Thus the overall risk for users and organizations is low given the limited exploitation probability and low severity rating.