This vulnerability enables a remote attacker to breach Chrome’s same origin policy by delivering a specially crafted HTML page to a headless instance. The flaw stems from an inappropriate implementation in the Chrome headless engine and is classified as medium severity by Chromium’s security team. If exploited, the attacker can gain unauthorized access to cross‑origin resources, potentially exposing sensitive data and executing arbitrary browser‑level operations for the target system.

Google Chrome, versions earlier than 151.0.7922.72, when running in headless mode.

The EPSS score is below 1 %, indicating a very low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the current CISA KEV catalog. However, the medium severity rating means that an attacker who can craft and serve the trigger page could successfully bypass origin restrictions. The attack vector is inferred to be remote via a crafted HTML payload delivered to the headless Chrome process.