Insufficient policy enforcement in the Speech API of Google Chrome allows a remote attacker who has already compromised the renderer process to read cross‑origin data. The flaw is a form of access‑control violation (CWE-284) that leads to unauthorized disclosure of information accessible to the page that is running in a different origin. This weakness does not provide code execution, privilege escalation, or denial of service; its impact is limited to confidentiality compromise.

The affected product is Google Chrome as identified by the CNA vendor/product list. The CVE payload does not specify affected versions or operating systems, so the issue applies to all Chrome installations that have not applied the recent patch. No version or OS details are provided in the supplied data.

The CVSS score of 4.3 classifies the vulnerability as low severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to already have compromised the renderer process, which typically means bypassing at least one security boundary first. Therefore, potential impact is constrained to confidentiality, but organizations with sensitive data should promptly apply the latest Chrome update and monitor for anomalous renderer activity.