Google Chrome’s Search component fails to enforce proper security policies, allowing a remote attacker to host a malicious HTML page that reads cross‑origin data from the victim’s browser context. The attacker can then exfiltrate that data to an external destination. Though the flaw presents a confidentiality risk, it does not grant code execution or privilege escalation, and the CVE tags the Chromium security severity as Low, indicating a modest threat level.

All installations of Google Chrome that are running a build earlier than 148.0.7778.96 are impacted. The CVE statement does not limit the issue to any particular channel or operating system; therefore, all platforms that support the affected Chrome release are susceptible.

The concern is remote; the attacker must persuade the user to navigate to a crafted HTML page. No authentication or elevated privileges are required. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 4.3 reflects that the attacker can only read data the browser permits, yet the confidentiality risk for sensitive users remains real.