Chrome’s Blink rendering engine contains an improper implementation that permits a remote attacker to read data from a web page that the browser should not have access to (CWE‑346). The attacker can craft a malicious HTML page that the browser loads, causing the engine to expose information from a different origin. The flaw leads to confidential data disclosure rather than code execution or denial of service.

Google Chrome for desktop. Versions earlier than 151.0.7922.72 are vulnerable. The issue was reported for the stable channel and applies to all operating systems using that release.

The CVSS score of 4.3 reflects a medium severity disclosure risk. EPSS indicates a very low exploitation probability (<1 %). The vulnerability is not currently listed in CISA’s KEV catalog, so there is no evidence of widespread exploitation. Attackers would need only to lure the victim to a crafted page, which is a simple HTTP or HTTPS request, so the attack vector is remote and broadly available.