Chrome’s Network component had an insecure direct object reference (CWE-346) that allowed a remote attacker to read data from a different origin through a specially crafted HTML page. The flaw bypasses normal same‑origin rules, enabling leakage of sensitive information accessed by the user’s browser session. The vulnerability is not a remote code execution but a confidentiality breach that can expose user data across sites.

Any desktop installation of Google Chrome older than version 151.0.7922.72 is potentially vulnerable. Users running earlier stable releases of the browser on Windows, macOS, or Linux could be affected.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Likely exploitation requires the attacker to host or force the loading of a malicious HTML page that the user visits, such as via a phishing link or compromised website. Because the attack vector is user‑initiated browsing, the overall risk is limited but remains present when the user interacts with untrusted content.