A flaw in Google Chrome’s implementation of the Presentation API allows a remote attacker to create a crafted HTML page that can read data from other origins. This results in a leakage of cross‑origin information, compromising the confidentiality of data that a user may have access to during normal browsing. The weakness has been identified as a failure to enforce the same‑origin policy, which is reflected by CWE‑346.

Any user running Google Chrome at a version earlier than 151.0.7922.72 on any platform with the Presentation API enabled is exposed. The vulnerability applies to the stable channel prior to the July 2026 update and is independent of operating system or device type.

The CVSS score of 4.3 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a malicious HTML page that a victim opens in Chrome; no additional credentials or local access are required for a successful exploit.