In Chrome versions prior to 152.0.7977.65, the Preload feature does not enforce proper authorization checks, allowing an attacker who compromises the renderer process to craft a malicious HTML page that bypasses the browser’s web origin policy. This loss of origin separation can lead to unauthorized data exposure or execution of actions constrained by same‑origin restrictions.

The flaw affects Google Chrome on desktop platforms running any version earlier than 152.0.7977.65. The issue was addressed in the stable channel update released in August 2026, referenced by the official Chrome release notes.

Chromium rates the vulnerability as low severity with a CVSS score of 4.3, and it is not listed in the CISA KEV catalog. The EPSS score is < 1 %, indicating no current proof of exploitation. The likely attack vector is via a compromised renderer process, inferred because the flaw requires that capability to craft the malicious preload. The attack requires the adversary to first compromise the renderer process, which is typically achieved via local or device compromise; therefore, the likelihood of widespread exploitation is low. Nonetheless, updating promptly reduces the risk of privilege escalation within the browser context.