The Background Fetch API implementation in Google Chrome up to version 144.0.7559.110 contains an oversight that permits a remote attacker to retrieve data from origins different from the one that served the malicious page. An attacker can craft an HTML page that initiates a background fetch request to a target domain. Due to improper origin checks, Chrome returns the response payload to the malicious page, leaking cross‑origin information. This flaw is a CWE-200 exposure of sensitive information to an unauthorized actor and also can be considered a CWE-284 improper access control issue.

Affected are all Google Chrome releases before 144.0.7559.110. The vulnerability exists in Desktop Chrome for Windows, macOS, and Linux in the stable channel and has been reported in Chromium's issue tracker under 474435504. Any user who opens a malicious web page while using one of those affected Chrome versions is susceptible.

The CVSS score is 6.5, classifying the issue as high severity from Chrome's perspective, but the EPSS score is below 1%, indicating a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack requires a user to visit a crafted web page in Chrome; no additional privileged access or network connections are needed. Once the attack vector is activated, data from the target origin is returned to the malicious page, allowing an attacker to exfiltrate sensitive information.