An insufficient policy enforcement in the Speech interface of Google Chrome versions prior to 151.0.7922.72 allows a remote attacker to bypass the browser’s site isolation protection by serving a specially crafted HTML page. This flaw can enable cross‑site information leakage or privilege escalation within the browser context, as the attacker can execute code in a victim’s isolated site environment. The vulnerability is classified as low severity by Chromium but presents a clear security risk to users who load malicious web content.

Google Chrome browsers with versions up to and including 151.0.7922.72 on any operating system.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a standard web visit to a malicious site that hosts a crafted HTML page exploiting the Speech API policy weakness. No additional privileges or local system access are required beyond normal browsing privileges.