Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 enables a remote attacker to extract cross‑origin data with a crafted HTML page. The vulnerability is an information exposure flaw typified by CWE‑346. An attacker who hosts or serves malicious content can force the victim's browser to reveal data from other origins, thereby compromising confidentiality. No injection, privilege escalation, or denial of service is attempted; the impact is limited to leaking sensitive browser‑side data.

Systems using Google Chrome before version 151.0.7922.72 are affected. Versions 151.0.7922.72 and later contain the fix. The issue is reported for the stable channel of Chrome; other channels such as beta or dev may also be impacted similarly if they have the same unpatched code.

The CVSS score of 4.3 indicates a low severity, and the EPSS score is < 1 %, implying a low likelihood of exploitation. Chrome users are not listed in CISA’s KEV catalog. The likely attack vector is a malicious web page that the user visits, where a crafted CSS policy is served by an attacker. The vulnerability can be triggered by that remote content but does not involve local privilege escalation or remote code execution. Therefore, the risk is primarily a low‑level data leakage scenario.