Insufficient validation of untrusted input in WebSockets allows a remote attacker who has compromised the renderer process to bypass the same‑origin policy via a crafted HTML page. The attacker can read, modify, or delete data from contexts belonging to other origins, potentially compromising the confidentiality and integrity of user data accessed by the browser. This flaw is a classic input‑validation issue (CWE‑20) combined with an improper origin check (CWE‑346).

The affected product is Google Chrome. All installations of Chrome running versions prior to 147.0.7727.55 are vulnerable, regardless of operating system. The vulnerability impacts any platform where Chrome is available, including macOS, Linux, and Windows.

The CVSS score of 6.5 indicates moderate severity, yet the EPSS score of less than 1 % suggests the likelihood of exploitation is presently low. This issue is not listed in the CISA KEV catalog. Exploitation requires a compromised renderer process and the delivery of a specially crafted page, meaning the attack vector is web‑based and dependent on user interaction. The resulting impact is primarily unauthorized access to data from other origins.