The vulnerability arises from a side‑channel in the navigation procedure of Google Chrome before version 147.0.7727.55. A remote attacker can deliver a specifically crafted HTML page that causes the browser to expose data belonging to a different origin. The exposure enables a confidentiality breach, allowing the attacker to read sensitive information that should be isolated by the same‑origin policy. This weakness is characterized by the CWE numbers 1300 and 346.

Google Chrome browsers on desktop platforms, any operating system, that are running a version older than 147.0.7727.55. Users with these early releases are at risk.

The CVSS score of 7.4 indicates a high threat level, while the EPSS score of less than 1 % suggests that large‑scale exploitation is unlikely at this time. The vulnerability is not present in the CISA KEV catalog. An attacker needs only to serve a malicious web page to the vulnerable client; no local privilege or network access is required. The attack vector is remote, through the browser’s rendering engine.