Google Chrome’s isolated web apps perform insufficient validation of untrusted input, which allows a remote attacker to craft malicious network traffic that leaks data from other origins. The weakness is an input validation error (CWE‑20) combined with a trust‑region check (CWE‑346). The result is that sensitive information can be read across origins without obtaining code execution or gaining local privileges.

Google Chrome installations that have not yet received the latest stable update are potentially vulnerable, as the CVE description indicates an issue before a certain build, but specific affected versions are not listed.

The CVSS score of 5.3 indicates a moderate severity, but the EPSS score of less than 1 % and the absence from the CISA KEV catalog suggest that exploitation is unlikely in the wild. The vulnerability can be triggered via remote network traffic sent to a victim’s browser and requires that the victim has an isolated web app enabled, but it does not permit arbitrary code execution or privilege escalation.