A flaw in ChromeDriver’s policy enforcement lets a remote attacker supply a specially crafted HTML page that bypasses the same‑origin policy. This omission can allow the attacker to read or manipulate content from other origins, potentially enabling data theft or execution of malicious code in the context of a victim’s browser, which is a significant integrity breach. The weakness is an access‑control failure (CWE‑284). The description indicates that the vulnerability is classified as medium severity by Chromium’s own assessment.

The vulnerability affects Google Chrome browsers that include ChromeDriver before the 146.0.7680.71 release. This includes installations on Windows, macOS, and Linux platforms where the legacy ChromeDriver component is active. Users of newer patched releases are not impacted.

The CVSS score of 6.5 denotes medium severity; however, the EPSS score is less than 1%, indicating a low probability of actual exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by delivering a crafted web page to a user running ChromeDriver, which suggests the attack vector is likely social‑engineering or local‑machine exploitation rather than a purely remote attack. Overall, the risk remains moderate but actionable before widespread exploitation occurs.