A vulnerability in Google Chrome allows a remote attacker to craft an HTML page that causes the browser to read information from the Document Object Model that it should not have access to. This results in an information leak that also bypasses the web origin policy. It is inferred from the description that this may lead to cross‑origin data exposure, though the description does not explicitly state such exposure.

All users running Google Chrome versions prior to 152.0.7977.65 are affected. The issue applies to desktop deployments of Chrome and is not limited to a specific operating system or platform.

The vulnerability can be triggered by a remote attacker who can host the crafted HTML page and lure a user to view it. Because the exploit requires the victim to open a specially designed web page, the likelihood of exploitation depends on user interaction and phishing success. The CVSS score is 4.3, the EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating a lower current exploitation likelihood. Nonetheless, as the impact involves breaching same‑origin boundaries, it poses a significant risk to confidentiality and integrity of web data.