The vulnerability arises from an inappropriate implementation in the ReportingAndNEL component of Google Chrome. The flaw, classified as CWE-346, permits a remote attacker to construct a crafted HTML page that can exfiltrate cross‑origin data from the victim’s browser. The attacker does not gain code execution or elevated privileges; instead the exposed information could reveal sensitive user data or private network resources accessible through the browser.

Google Chrome consumer builds prior to version 151.0.7922.72 are affected. The fix was released in the stable channel update for desktop versions 151.0.7922.72 and later.

The CVSS score of 4.3 indicates a medium severity issue that primarily leads to information disclosure. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. The attack most likely requires a user to open or interact with a malicious web page crafted by the attacker; a compromised or malicious site could serve the exploit. Because the weakness is client‑side, mitigation focuses on preventing exposure to the vulnerable browsers rather than preventing server‑side impact.