The flaw is an inappropriate access‑control rule in Chrome’s WebProtect that allows a remote attacker who has already compromised the renderer process to read data from cross‑origin origins. The advisory does not specify the precise types of data that can be exfiltrated, but any content that browsers handle could be exposed. This is a classic broken access‑control vulnerability identified as CWE‑346. The primary impact is loss of confidentiality for browsers that have been breached.

Google Chrome versions earlier than 151.0.7922.72 are vulnerable. The issue appears to apply to all desktop platforms that use the renderer component such as Windows, macOS, and Linux, although the advisory does not explicitly list each OS. The vulnerability is tied to the renderer process in the browser.

The CVSS score of 4.3 indicates a medium severity with a main focus on confidentiality. The EPSS score of less than 1% suggests that exploitation in the wild is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker must first gain control of the renderer process—a step that usually requires a separate attack vector such as a browser exploit or malicious site—before crafting a page that triggers the data leak. The likely attack vector is a remote compromise of the renderer followed by a crafted HTML page, making this a somewhat advanced exploitation scenario with limited likelihood.