The flaw lies in how Google Chrome implements the Permissions API, allowing a malicious web page to mis‑handle permission requests and thereby bypass the browser’s same‑origin policy. An attacker can serve a crafted HTML page to a victim and, through the altered permissions handling, read or modify data that should be confined to a different origin, or perform actions on the victim’s behalf. The vulnerability is categorized as CWE‑346.

All desktop versions of Google Chrome older than 151.0.7922.72 across platforms are affected. Users on these releases remain vulnerable regardless of operating system or environment.

With a CVSS score of 6.5, the vulnerability poses a moderate impact. However, the EPSS score of less than 1% indicates that the likelihood of exploitation is currently low, and the issue is not listed in the CISA KEV catalog. The attack requires the victim to visit or interact with a malicious website, a common vector for phishing or drive‑by attacks. If exploited, the attacker could exfiltrate confidential data, compromise credentials, or inject malicious scripts into the victim’s browsing context.