The vulnerability is an insufficient validation of untrusted input in the CORS handling code of Google Chrome, which permits an attacker who has already compromised the renderer process to bypass the browser’s same‑origin policy using a specially crafted HTML page. This can enable the attacker to read or modify data that would otherwise be protected by the same‑origin restriction, potentially exposing user data or compromising the integrity of the web page. The weakness is identified as CWE‑20 (Improper Input Validation) and CWE‑346 (Insecure Direct Object Reference).

Google Chrome browsers running any version preceding 148.0.7778.96 are affected. The issue was present in all channels (stable, beta, dev) prior to the 148.0.7778.96 release when the CORS validation logic was corrected.

The CVSS score is 3.1, indicating low severity. The exploit probability is quantified by an EPSS score of < 1% (0.0003), and the vulnerability is not listed in the CISA KEV catalog. The practical exploitability requires first compromising the renderer process, which generally means the user must visit malicious content or be affected by another flaw that can reach the renderer. Consequently, the risk level can be considered low, but organizations should monitor for emerging exploitation techniques and enforce regular updates to Chrome.