The vulnerability in Google Chrome prior to version 151.0.7922.72 is a side‑channel information leakage that enables a remote attacker to retrieve cross‑origin data by serving a specially crafted HTML page. The flaw is a misuse of information from the network (CWE‑1300) combined with insecure handling of relative resources (CWE‑346), leading to unintended exposure of sensitive data. The attacker cannot modify or execute code, but can exfiltrate internal state and potentially violate the browser’s origin isolation guarantees.

Google Chrome users running any version earlier than 151.0.7922.72 are affected. This includes the stable channel builds on desktop platforms. No specific minor releases are listed beyond the overall threshold.

The CVSS score of 4.3 indicates a low level of overall risk, and the EPSS score of less than 1 % demonstrates a very low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a crafted web page that the user opens, which then exploits the browser’s network stack to read data from another origin. An attacker can subsequently gather the leaked information if the user locally visits an internal site or if the browser accesses protected resources.