While a media component in older Chrome versions stored sensitive data unprotected, this issue leads to side‑channel leaks that can disclose cross‑origin information to an attacker who serves a specifically crafted web page. The flaw is a result of improper isolation between media buffers, classified as CWE‑1300, and does not require privileged execution. The potential consequences are limited to confidentiality of content accessible through the victim’s browser session rather than arbitrary code execution or privilege escalation.

The affected product is Google Chrome, any version earlier than 151.0.7922.72, across all desktop platforms, and is listed by CNA as Google:Chrome. All users of the unstable, beta, stable channel could be impacted until the new channel release.

The CVSS score of 4.3 categorizes the weakness as low‑to‑medium severity, and the EPSS score is below 1 %, meaning current empirical exploitability is thought to be minimal. The vulnerability is not present in the CISA KEV catalog. A likely attack path is a remote web page that tricks the victim into loading media content, thereby inducing the side‑channel leak. Given the low exploitation probability, monitoring for signs of abuse may be sufficient until a security update is applied.