This vulnerability arises from an inappropriate implementation in Chrome extensions, allowing an attacker who persuades a user to install a malicious extension to read and leak cross‑origin data. The weakness is a form of improper access control (CWE‑284) and an authorization bypass through user‑controlled keys (CWE‑346). The consequence is that private information originating from other domains can be exfiltrated, potentially exposing sensitive user data without the user’s awareness.

The flaw exists in Google Chrome versions prior to 151.0.7922.72. Any user running an affected build of the Chrome browser and installing an extension can be impacted.

With a CVSS score of 4.3 the severity is medium. The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of active exploitation at this time. Exploitation requires social engineering to convince a user to install a crafted extension; a successful attack would grant unauthorized cross‑origin data access rather than remote code execution.