Technical impact
The vulnerability in Google Chrome arises from an inappropriate handling of the Content Security Policy header, permitting a crafted HTML page to bypass CSP restrictions. A remote attacker can host a malicious page that, when visited by an affected user, executes arbitrary scripts or loads untrusted resources in the context of the page. This effectively breaks the intended isolation between content and script, enabling potential data theft or session hijacking.
Affected Systems
Affects Google Chrome on all platforms before version 151.0.7922.72, including stable, beta, and dev channels. Official upgrade recommendation is to install Chrome 151.0.7922.72 or newer from the stable channel.
Risk and Exploitability
The CVSS score of 6.5 indicates medium severity, while the EPSS score of < 1% suggests a low predicted exploitation probability. It is not listed in CISA KEV. The likely attack vector is remote, via a crafted HTML page that a user visits or opens. Once an affected browser is loaded, the attacker can bypass the site's Content Security Policy, allowing execution of arbitrary scripts or loading of untrusted resources that can lead to data theft, session hijacking, or other malicious activity.
Debian DLA
Debian DSA