An inappropriate implementation in the Blink rendering engine of Google Chrome allows an attacker to create a crafted HTML page that causes the browser to read cross‑origin data and return it to the attacker. This flaw permits the leakage of confidential information that the user has accessed during the session, without the user’s awareness.

Google Chrome installations earlier than version 151.0.7922.72 are vulnerable, as the defect resides solely in the Blink component of those releases.

The CVSS score of 4.3 places the vulnerability in the low severity range, and the EPSS score of less than 1 percent indicates a very low probability of exploitation. The issue is not listed in the CISA KEV catalog. An attacker would need to supply or host the malicious HTML page and entice a user to load it; the data exfiltration is limited to information already cached in the browser session. CWE‑346 denotes that the weakness involves improper authentication or access control through origin spoofing.