A remote attacker can exploit a lack of policy enforcement in the Chrome FileSystem API to leak data that should be confined to a different origin. By serving a specially crafted HTML page, the attacker can read files across origin boundaries, exposing sensitive information. The Chromium team has classified the vulnerability as High severity.

All desktop installations of Google Chrome with a version number prior to 151.0.7922.72 are affected. The issue is triggered when the FileSystem API is used by a website that does not correctly check the requesting domain’s permissions.

The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of widespread exploitation at present. However, the high impact means that once exploited a single victim can obtain confidential data. Exploitation requires the victim to load the crafted page, so the attack vector is remote through user interaction. Given the severity, the risk remains elevated until the patch is deployed.