The vulnerability is an inadequate implementation of the same‑origin policy used by the Blink rendering engine in Google Chrome versions older than 151.0.7922.72. A malicious web page can construct special content that tricks the browser into treating data from a different origin as if it were same‑origin, effectively breaking the enforced boundary. This leads to unauthorized reading of cross‑origin resources and potentially further privileged actions, depending on the capabilities of the exploited page. The weakness falls under CWE‑346, broken access control.

Affected product is Google Chrome. Versions prior to 151.0.7922.72 are impacted. The same‑origin policy bypass is flagged as medium severity by Chromium security.

The CVSS score of 6.5 signals medium severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker hosting a crafted HTML page that a user visits; no additional conditions such as elevated privileges are required beyond normal browsing. With the same‑origin policy broken, an attacker could read or manipulate sensitive data from other origins, enabling credential theft, data exfiltration, or further drive‑by attacks.