Inappropriate implementation in the ORB component of Google Chrome allows a remote attacker to expose data that should be inaccessible across origins through a manipulated HTML page. The flaw is rated medium severity and corresponds to CWE-346, improper handling of authenticated data leaks. An attacker can fabricate a page that a victim browser loads, causing unintended data to be transmitted to the attacker without the user’s knowledge.

The vulnerability exists in all builds of Google Chrome prior to version 151.0.7922.72. Users running those releases are exposed to cross‑origin data leakage when they visit malicious or crafted web pages. The affected platforms are those that support Chrome, and based on the description, it is inferred that any such platform is susceptible.

The CVSS base score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. A remote attacker can exploit the flaw by hosting a crafted HTML page that the victim visits, resulting in exfiltration of sensitive data. The attack requires only client‑side participation and no additional credentials.