A flaw in the Enterprise implementation of Google Chrome on Windows allows a remote attacker to leak cross‑origin data by delivering a malicious file, violating the principle of origin isolation. This results in unauthorized visibility of content from other domains, potentially exposing sensitive information. The vulnerability is cataloged as CWE‑346, which indicates insufficient origin validation during data handling.

Microsoft Windows systems running Google Chrome versions earlier than 151.0.7922.72 are affected. The issue is limited to the browser’s handling of file inputs in the Enterprise context and does not impact other Google products or operating system components.

The CVSS score of 4.3 marks the flaw as low severity, and an EPSS of <1% shows a very small chance of exploitation in the wild. Although the vulnerability is not listed in the CISA KEV catalog, the attack vector is inferred to be remote, requiring the attacker to supply a malicious file to the victim’s Chrome installation. No known exploit code is publicly available, but the logic allows data exfiltration if the file is opened or processed by the browser.