This vulnerability is a side‑channel information leakage in the media handling component of Google Chrome. A specially crafted HTML page can trigger the leak, allowing a remote attacker to read data that belongs to another origin. The weakness is a CWE‑1300 media handling flaw and a CWE‑205 cross‑origin leakage. The impact is unauthorized disclosure of content that the victim browser has access to, such as in‑page resources, cached media, or other sensitive data protected by the same‑origin policy.

The flaw affects all installations of Google Chrome that are older than version 151.0.7922.72. Any user running a vulnerable build and visiting a malicious page can be impacted. Updated browsers from Google’s stable channel have the fix applied.

Based on the description, it is inferred that the attack flow requires the victim to open a crafted HTML page in a browser that has not yet applied the patch. The CVSS score is 4.3, which classifies the vulnerability as medium severity. EPSS is below 1%, indicating a very low probability that this weakness is actively exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog. The impact is limited to remote content delivery and does not provide code execution or privilege escalation. The remote attacker can use this side channel to exfiltrate cross‑origin data to their server.