Insufficient enforcement of clipboard policy in Chrome before 146.0.7680.71 lets a compromised renderer process access and leak data that originates from a different origin when a specially crafted HTML page is loaded. The result is a breach of confidentiality, allowing the attacker to exfiltrate sensitive information that was previously protected by cross‑origin boundaries. The weakness manifests as a failure to adequately authorise clipboard access and is identified as CWE‑284.

The flaw affects Google Chrome on all platforms (Windows, macOS, Linux) prior to version 146.0.7680.71. No other vendors or versions are listed as vulnerable in the CNA data.

The CVSS v3.1 score of 6.5 indicates moderate severity, while the EPSS rating of less than one percent suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a pre‑existing compromise of the renderer process, likely achieved through a separate flaw or social‑engineering attack, after which the attacker can craft a page that reads clipboard data and exfiltrates it. Given the requirement for a local compromise and the low EPSS probability, the overall risk is moderate but not imminent.