The vulnerability is a side‑channel information leak that occurs during navigation in Google Chrome. A maliciously crafted HTML page can trigger the browser to reveal data that belongs to other origins, enabling a remote attacker to read sensitive information. The issue is identified as CWE‑1300 for side‑channel leakage and CWE‑346 for logic flaw, and it does not provide execution of code or denial of service; its primary consequence is a confidentiality breach that may be used for credential theft or phishing amplification.

All installations of Google Chrome that run any operating system—macOS, Linux, or Windows—are affected if the browser version is earlier than 147.0.7727.55. The vulnerability is fixed in Chrome 147.0.7727.55 and later, so updates beyond that version remove the flaw.

The CVSS score of 6.5 rates the vulnerability as medium severity, and the EPSS score of less than 1% suggests that attacks are currently rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: a malicious web page that a user visits can trigger the leak, with no requirement for local privileges or advanced user knowledge. While the impact is limited to data leakage and does not allow arbitrary code execution, the ability to read cross‑origin data raises the risk of confidential information exposure.