Google Chrome’s media handling module contains insufficient validation for untrusted input. This flaw enables a remote attacker who has already compromised the renderer process to serve a crafted HTML page that can read data from other origins. The vulnerability is classified as CWE‑20 and CWE‑346, indicating unchecked input validation and logic‑based access control failures. As a result an attacker can exfiltrate sensitive information that should be protected by the same‑origin policy.

Any Windows desktop build of Google Chrome running a version earlier than 151.0.7922.72 is affected. This includes the stable channel released before the July 2026 update, as well as any beta or dev branches that have not applied the same patch. No other browsers or platforms are listed as impacted by this issue.

The CVSS score of 4.3 reflects moderate severity, and the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. Because the attack requires a prior compromise of the renderer process, the practical risk is limited to scenarios where an attacker has already achieved a foothold through another vulnerability. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited current exploitation evidence. Nonetheless, users should apply the security update promptly to eliminate the data leakage vector.