The flaw is an insufficient enforcement of security policy within the Search component of the Chrome browser. A remote attacker can craft a malicious HTML page that, when opened by a victim, allows the attacker to read data from cross‑origin sources that are otherwise protected by the browser’s same‑origin policy. This data can then be exfiltrated to an external site, creating a confidentiality breach. The vulnerability does not provide code execution, privilege escalation, or denial of service capabilities.

Any installation of Google Chrome built before version 148.0.7778.96 is affected. The issue is not limited to a specific channel or operating system, so all platforms that support the vulnerable Chrome release are at risk.

Exploitation requires a user to open a crafted page, so it is a remote, user‑interaction vulnerability. No additional authentication or elevated privileges are needed. The EPSS score of < 1% indicates an extremely low likelihood of exploitation, and the CVSS score of 4.3 confirms a modest severity. The flaw is not listed in CISA’s KEV catalog, and the only impact is potential cross‑origin data leakage.