Insufficient validation of untrusted input in the Loader component of Google Chrome allows a remote attacker that has already compromised the renderer process to craft a page that causes cross‑origin data to be leaked. The flaw results in a confidentiality compromise consistent with CWE‑20.

All users of Google Chrome on the stable channel prior to revision 151.0.7922.72 are affected, regardless of operating system. Versions newer than 151.0.7922.72 have the fix and are not vulnerable.

The CVSS score of 6.5 indicates medium severity and the EPSS score is below 1%, indicating a low estimated chance of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a prior compromise of the renderer process, which can occur via other browser weaknesses or malware. Once the renderer is compromised, an attacker can deliver a crafted page that abuses the Loader to read and exfiltrate data from other origins. This limits real‑world risk but still poses a confidentiality threat, particularly in environments that allow untrusted content.