A flaw in the way the DataTransfer object is handled in Google Chrome allows a malicious website to access data that originated from a different origin. Through a specially crafted HTML page, an attacker can trigger a data transfer that leaks this cross‑origin information to the page, thereby exposing sensitive data to an unintended third party. The weakness results in an information disclosure vulnerability without immediate impact on code execution or direct denial of service.

Google Chrome browsers running versions earlier than 151.0.7922.72 are affected. The vulnerability specifically targets the DataTransfer implementation in the stable channel of Chrome on desktop platforms.

The vulnerability carries a CVSS score of 4.3, indicating low severity, and an EPSS score of less than 1%, implying a low probability of exploitation. It is not listed in the CISA KEV catalog. The attack can be carried out remotely from a compromised web page, leveraging standard browser features so that no privileged access is required to trigger the data leakage.