A side‑channel flaw in the favicon handling of Google Chrome versions prior to 151.0.7922.72 allows a malicious web page to read data from other origins. The flaw permits a remote attacker to leak cross‑origin sensitive information, such as cookies or local storage, by crafting an HTML page that triggers the leak. This medium‑severity vulnerability, with a CVSS score of 4.3, results in possible information disclosure without privilege escalation.

All users of Google Chrome running versions earlier than 151.0.7922.72 are affected. The issue applies to the desktop Chrome product on any operating system where the outdated version is installed; there are no specific platform constraints noted.

The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that a victim visit a crafted web page that utilizes the flawed favicon mechanism, allowing a remote attacker to read cross‑origin data, but does not require elevated privileges or local access. With a CVSS score of 4.3, the risk is moderate, and immediate patching is recommended to eliminate the information‑disclosure vector.