An insecure implementation of Chrome DevTools creates an opportunity for a remote attacker, using a crafted HTML page, to circumvent the browser’s same‑origin policy. The flaw stems from improper handling of certain DevTools features, enabling cross‑origin data access and potential unauthorized information disclosure or session hijacking.

The vulnerability affects all Google Chrome installations running versions prior to 151.0.7922.72. Users of the stable channel before this build are at risk.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% shows that malicious exploitation is unlikely at this time. The vulnerability is not currently listed in the CISA KEV catalog, and there is no known widespread exploitation. Attackers would need to host a specially crafted webpage and convince users to open it or exploit a yet‑unknown browsing flaw that triggers the DevTools path. Even though the exploitation window is narrow, the impact of a successful bypass—access to third‑party content, cookie theft, or bypassing content‑security restrictions—makes the risk noteworthy for high‑value assets.