The vulnerability involves performing operations on a network resource after it has expired or been released in Chrome’s rendering engine. This flaw allows a remote attacker who has already compromised the renderer process to bypass the browser’s web origin policy. The result is that the attacker can read or manipulate data from other origins that the user can access, potentially exposing sensitive information or altering site content. The issue is coded as CWE‑672.

Vendor: Google, Product: Chrome. Versions before 152.0.7977.65 for desktop are vulnerable.

The CVSS score is 4.3 and the EPSS score is < 1%, indicating a low but nonzero probability of exploitation. Chromium lists the issue as medium severity. Based on the description, it is inferred that an attacker must first gain a foothold in the renderer process, typically through malicious content or a rogue extension. Once the renderer is compromised, a crafted HTML page can trigger the faulty resource handling, enabling cross‑origin reads or writes that are normally disallowed. Because the attack vector is a crafted web page and a renderer compromise is required, the risk is moderate, though not trivial.