Insufficient validation of untrusted input in the Permissions feature of Google Chrome prior to version 148.0.7778.96 can allow an attacker on the same local network segment to initiate malicious network traffic and extract data that belongs to a different origin. The flaw is a classic input validation weakness (CWE‑20) and was rated as medium severity by Chromium.

All installations of Google Chrome that have not been updated to at least version 148.0.7778.96 are vulnerable. This includes desktop clients on Windows, macOS, Linux, and related mobile variants that have not applied the latest stable channel update.

The vulnerability requires an attacker to be on the same local network segment and to be able to send crafted network traffic to Chrome. No public exploit code or remote code execution capability is hinted, and EPSS data is unavailable, though the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 4.3 indicates a medium severity risk. The attack vector is local and thus easier to trigger in unprotected, shared‑network environments, making the risk moderate to high for networks that allow unmanaged devices to communicate with the browser.