An incorrect reference resolution bug in Chrome’s Preload functionality can be abused by a remote attacker to break the web origin policy. A crafted HTML page can cause the browser to adjust a reference to point to a different origin, allowing the attacker to read or modify data that would normally be protected by cross‑origin restrictions. The flaw is classified as a CWE‑706 weakness, where the browser fails to correctly validate the origin of a loaded resource.

Google Chrome browsers older than version 152.0.7977.65 are affected. The vulnerability exists in the stable channel of Chrome before this release.

The CVSS score of 4.3 places the issue in the low‑to‑medium severity range according to standard scoring. The attack is remote and requires the victim to open a maliciously crafted page. An attacker could potentially read sensitive data or inject malicious content from disallowed origins. The EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog, indicating no publicly known exploit at this time.