This vulnerability stems from an incorrect implementation of cross‑origin resource sharing in Google Chrome on Linux and ChromeOS. The flaw allows a malicious web page to bypass CORS checks and read data from a different origin, resulting in unauthorized disclosure of content that should be protected by same‑origin policies. The primary impact is loss of confidentiality, with the possibility of further social engineering or exploitation once sensitive data is exposed. The vulnerability is classified as CWE‑940 and the newly identified CWE‑942.

All users running Google Chrome on Linux or ChromeOS with a browser version older than 148.0.7778.168 are affected. Updating to version 148.0.7778.168 or later removes the vulnerability.

Chromium assigns a Medium severity rating, reflected in a CVSS score of 4.3. The EPSS score is reported as <1%, indicating a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers must entice a user to visit a crafted malicious web page, making the vector remote yet dependent on user interaction. Successful exploitation would expose any data that is normally guarded by CORS checks on the victim’s machine. The issue aligns with CWE‑940 and CWE‑942.