An integer overflow in the Network module of Google Chrome controls how the renderer process parses certain HTML constructs. The flaw permits a remote attacker who has already compromised the renderer to craft a malicious HTML page that causes the overflow, subverting the same‑origin enforcement. The resulting bypass can expose cross‑origin data, inject unauthorized scripts, and facilitate further exploitation of the user’s environment. The issue is classified as Medium severity by Chromium, indicating a meaningful but not critical risk when conditions for exploitation are met.

Google Chrome versions prior to 148.0.7778.96 on desktop platforms are affected. Users must verify their installed version and upgrade if earlier.

The CVSS score of 4.3 signifies a medium severity level. No EPSS score is publicly available and the vulnerability is not listed in CISA's KEV catalog, which places the exploitation probability in a moderate band. Exploitation requires a remote attacker who has already compromised the renderer process, indicating that the attack vector is through a crafted HTML page served to the user. If successfully leveraged, the attacker can override the browser's same‑origin policy to read or manipulate data from another domain, potentially enabling data theft or session hijacking.