An improper implementation of the SurfaceCapture feature in Google Chrome allows a remote attacker to leak data from a different origin by serving a specially crafted HTML page. The flaw permits the browser to capture and expose cross‑origin content, resulting in a confidentiality breach for users who load the malicious page. The vulnerability is classified under CWE‑346 (Data from Untrusted Origin Used in Operation) and CWE‑940 (Direct Data Leak from Protected Source).

All installations of Google Chrome running a version older than 151.0.7922.72 on any operating system are affected. Any user who visits a malicious page without updating the browser risks disclosure of cross‑origin information.

The CVSS score of 4.3 indicates a low severity impact, and the EPSS score of less than 1 % shows a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a crafted web page that the victim visits, but no advanced privileges or local code execution are needed. The principal attack vector is remote through user interaction with a malicious website.