The vulnerability results from insufficient validation of untrusted input in the Actor component of Google Chrome. An attacker who has already compromised the renderer process can craft a malicious HTML page that triggers the flaw and extracts information that normally would not be accessible across origins. This leads to a cross‑origin data leakage, exposing sensitive content to the attacker. The weakness is categorized under CWE‑20 and CWE‑346, which address improper input validation and the failure to reject untrusted input, respectively.

The flaw affects all installations of Google Chrome running versions prior to 151.0.7922.72 on the stable channel. Users of the affected browser build on any platform are potentially impacted, as the Actor component is part of the core rendering engine.

The CVSS score of 4.3 places the vulnerability at a moderate risk level, and the EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to already have compromised the renderer process, a non‑trivial prerequisite, but once achieved it allows the attacker to exfiltrate cross‑origin data via a crafted page.