This vulnerability allows a remote attacker who has already compromised the Chrome renderer process to read cross‑origin data through a crafted HTML page. The failure is due to insufficient enforcement of the CORS policy, meaning the browser fails to block or properly restrict such cross‑origin requests. Consequently the attacker can gain confidential information from other origins, resulting in an information disclosure. The flaw is listed with Chromium security severity “High”.

Google Chrome versions released before 147.0.7727.101 are vulnerable. The issue appears on the stable channel of Chrome. All users running a version earlier than 147.0.7727.101 are affected until the patch for the stable channel is deployed.

The CVE record has a CVSS score of 3.1, and it is not listed in the CISA KEV catalog. The vulnerability requires that the attacker first succeed in compromising the Chrome renderer process, which is non‑trivial and limits the likelihood of exploitation in a public setting. However, given the high Chromium security severity and the ease with which the renderer process could be exploited by other flaws, the risk should be considered significant until the issue is fixed.