This vulnerability permits a remote attacker to leak cross‑origin data from Google Chrome via a crafted HTML page. The flaw lies in the NoStatePrefetch mechanism, which unintentionally allows sensitive information to be read by a non‑trusted origin, arising from shortcomings captured by CWE-1300 (Uncontrolled Resource Consumption) and CWE-205 (State Found in Wrong Place). The attack does not provide code execution or direct hijacking of the browser, but it can expose user data such as cookies, form inputs, or cached resources that were previously stored by the browser.

All users running Google Chrome before version 151.0.7922.72 are potentially affected. The issue is limited to the desktop stable channel of Chrome and does not affect other products or mobile variants listed by the CNA.

The CVSS score of 4.3 classifies the vulnerability as medium severity, and the EPSS score indicates a very low probability of exploitation. Because the attack requires a crafted web page to be visited, the main threat vector is remote via the web. The vulnerability is not currently listed in the CISA KEV catalog, suggesting that exploit activity is not widespread. Adhering to the vendor’s recommended mitigations will reduce the risk of cross‑origin data leakage.