The CVE description notes incomplete cleanup in Chromium before version 152.0.7977.65, allowing a remote attacker to craft a malicious Chrome extension that bypasses the browser’s same‑origin policy. Based on the description, it is inferred that the cleanup issue involved temporary UI components during the rendering lifecycle. This weakness could enable an attacker to read or modify JavaScript context and data normally restricted by origin boundaries. The vulnerability is identified as CWE‑459 – Incomplete Cleanup of Resource.

All users of Google Chrome editions built prior to version 152.0.7977.65 are potentially affected. The issue is tied to the Chromium component that Chrome bundles, so any instance derived from that source code before the patch is vulnerable.

The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation at this time. The CVSS score of 6.5 indicates moderate severity according to standard metrics; it still requires a targeted, social‑engineering attack where the attacker convinces a user to install a crafted extension. If successful, the attacker could obtain arbitrary access to data and scripts from the user’s browsing sessions.