A flaw in the Loader component of Google Chrome allowed a remote attacker to craft an HTML page that caused the browser to expose cross‑origin data. The vulnerability is a medium‑severity weakness (CWE‑346) that could enable an attacker to read data from another origin in the victim’s browser context.

All users running Google Chrome versions older than 151.0.7922.72 are potentially affected. Users on earlier stable channel releases—especially versions released before the July 2026 update—must verify whether they are on a pre‑151.0.7922.72 build.

The CVSS score of 4.3 indicates limited impact, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to host a malicious web page that the user visits; no privileged access or additional preconditions are reported in the description. The exploitation path is therefore based on a crafted HTML page served from any remote source.