The vulnerability is a CSS injection flaw found in Google Chrome versions prior to 152.0.7977.65. A remote attacker can deliver a specially crafted HTML page that injects malicious CSS, potentially causing the browser to expose sensitive information from the user's context. The flaw is represented by CWE-74, which describes unsanitized use of user-controlled input in style contexts. While the severity is rated medium by Chromium, the potential impact is misuse of confidential data if an attacker can execute the injection.

The affected product is Google Chrome, and the vulnerability applies to all releases before version 152.0.7977.65. Users should verify that their browsers have been updated to at least that release to eliminate the flaw.

The EPSS score for the vulnerability is < 1%, indicating a low probability of exploitation, and it is not listed in the CISA KEV catalog. The cautionary severity in Chromium is medium, indicating that while exploitation is possible, it may require crafted input and a user to load the malicious content. The likely attack vector is a web page that an attacker controls or can affect, which uses injected CSS to read or leak exploitable data. Given that the vulnerability is not widely exploited in the field, the risk level is moderate but still deserving of patching to avoid potential data exposure.