An inappropriate implementation in the Preload feature of Google Chrome allowed a remote attacker to leak cross‑origin data via a crafted HTML page. The vulnerability can expose sensitive content from other origins, leading to a confidentiality breach. The Chromium security team rated the issue as low severity, but the potential data exposure remains significant for users visiting maliciously crafted sites.

Google Chrome is affected, specifically any installation prior to version 148.0.7778.96. Users running these older Chrome releases are susceptible to the data leakage flaw.

The EPSS score is <1% and it is not listed in the CISA KEV catalog, indicating a very low probability of exploitation and no known widespread exploitation. The likely attack vector is remote, stemming from a maliciously crafted web page that the victim loads. An attacker can exploit the bug by tricking a user’s browser into loading a specially designed page that triggers the Preload mechanism, thereby leaking data from a different origin. While the severity rating is low, the confidentiality impact is real and remediation is advised.