An incorrect authorization mechanism in Google Chrome allows a remote attacker to bypass the web origin policy by serving a crafted HTML page. A malicious page can exploit this flaw to read or manipulate data from other origins, leading to cross‑origin content theft, script injection, or other integrity violations. The defect is classified with a medium Chromium security severity, indicating a meaningful impact on confidentiality and integrity for users who load the malicious page.

Google Chrome stable channel versions prior to 152.0.7977.65 on desktop systems are affected. The issue was fixed in the August 2026 stable update, so any Chrome installation older than that release remains vulnerable.

The EPSS score of < 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 4.3 suggests moderate severity. Based on the description, the likely attack vector involves a remote attacker delivering a crafted HTML page that the victim opens in Chrome. While the precise exploitation conditions are not detailed, the absence of a known public exploit and the low EPSS score suggest moderate risk to users who visit compromised sites. Updating to the fixed version mitigates the risk entirely.