The vulnerability stems from an improper Navigation implementation in Google Chrome, allowing an attacker who has already gained access to a renderer process to read data from a different origin by loading a specially formed HTML page. This flaw enables cross‑origin data leakage, exposing sensitive information that should be protected by the same‑origin policy. The Chromium team rates the vulnerability as low severity.

All versions of Google Chrome prior to 147.0.7727.55 are affected. The flaw exists in the renderer component of the browser; it is only exploited when the attacker can compromise that process. Users on older Chrome releases should be aware that the flaw remains until the release that contains the fix.

Because the flaw requires the attacker to control or compromise a renderer process, the overall attack surface is limited compared to arbitrary code execution or denial‑of‑service exploits. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The Chromium security severity is low, suggesting that the risk of exploitation in the wild is currently modest. Nonetheless, if an attacker can attain renderer‑process compromise by any means, the cross‑origin leakage could expose private user data.