This vulnerability allows an attacker who has somehow compromised the renderer process to circumvent the web origin policy by crafting a malicious HTML page. The underlying weakness is an incorrect authorization check, classified as CWE‑863. By obtaining the ability to bypass the origin policy, the attacker could read or interact with resources on other origins that should be protected, effectively enabling unauthorized data access and potential further exploitation.

Google Chrome versions prior to 151.0.7922.173 are affected. The issue may be present in any build of Chrome that does not incorporate the fix released in that update.

The CVSS score is 8.1, indicating high severity per Chromium’s security team. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires the attacker to first gain control of the renderer process and then persuade a user to load a crafted page, indicating that it probably needs user interaction and social engineering. Given the high impact of bypassing the origin policy, this represents a significant risk to applications and data accessed through Chrome.