Technical impact
The vulnerability stems from insufficient policy enforcement in the ServiceWorker implementation of Google Chrome. A remote attacker can craft a malicious HTML page that, when opened, registers a ServiceWorker that bypasses Chrome's same‑origin policy, classified as CWE‑284 and CWE‑940. This flaw can enable an attacker to read or manipulate data across origins that should remain isolated, potentially exposing sensitive user credentials, cookies, or other private information.
Affected Systems
Google Chrome versions prior to 151.0.7922.72 are affected. Systems using earlier stable channel releases are at risk until the vulnerability is mitigated by updating the browser.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity, whereas the EPSS score of less than 1% suggests exploitation probability is currently very low. The flaw is not listed in the CISA KEV catalog. An attacker would need to host a crafted HTML page and lure the victim to open it, after which the ServiceWorker executes in a jurisdiction that violates the same‑origin restriction. The attack requires the victim to engage with the malicious page and may be mitigated by standard web‑browser user‑alert measures.
Debian DLA
Debian DSA