The vulnerability involves an inappropriate implementation of the editing feature in Google Chrome for Linux that predates version 151.0.7922.72. A remote attacker can craft a malicious HTML page that, when loaded in the browser, triggers the editing functionality and leaks data from a different origin. The leak exposes confidential information and is classified as a confidentiality impact consistent with CWE‑200, while the flaw itself is tied to improper handling of editing input (CWE‑1021).

Affected is Google Chrome running on Linux. The issue exists in all releases older than 151.0.7922.72. Users on the stable channel with earlier versions are at risk until they upgrade.

The CVSS base score is 3.5 indicating a low severity vulnerability, and the EPSS score is reported as less than 1 %, meaning exploitation likelihood is very low. The vulnerability is not listed in CISA KEV. Attackers would need to host a malicious crafted HTML page and convince a user to visit it, so the attack vector is remote and web‑based. Due to the low score and minimal exploitation probability, the risk remains low but should still be mitigated before new critical updates are released.