A remote attacker can craft an HTML page that tricks Google Chrome into bypassing the browser’s same‑origin policy. The flaw, an example of CWE‑863 Authorization Bypass through Incorrect Authorization, arises from incorrect authorization in the Network stack, which allows any origin to access resources that normally would be restricted under the web origin policy. This results in potential data disclosure or manipulation of data the user sees in the browser.

The vulnerability exists in Google Chrome versions earlier than 152.0.7977.65. All users running a vulnerable build are at risk until they upgrade to the patched version or a newer release.

The security severity assigned by Chromium is Medium, with a CVSS score of 4.3. The EPSS score of 0.00188 indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not yet been observed. Typical exploitation would require a user to open a maliciously crafted HTML page, such as via a phishing email or compromised website. Because the attack relies on user interaction with the browser, the overall risk is moderate but still significant for environments with sensitive web data.