An attacker can craft an HTML page that exploits a flaw in the handling of Frames within Google Chrome versions prior to 153.0.8010.36. By loading the page in a victim’s browser, the attacker causes the browser to expose sensitive information without the user’s knowledge or consent. The weakness is a classic information‑over‑exposure flaw classified as CWE‑200, which can potentially allow an attacker to read data that should be kept confidential.

Google Chrome users running a version earlier than 153.0.8010.36 are affected, regardless of platform. The problem was present in the desktop stable channel and does not extend to other products or channels without a corresponding version number.

The vulnerability is remote and can be triggered by a crafted webpage that a user visits or opens. While the CVE is rated low in Chromium’s internal severity, disclosure of private data can have serious business or personal consequences. No exploitation data from CISA’s KEV catalog is available, and EPSS is not publicly published, but the attack would require merely a victim accessing a malicious page, which is a common user behavior.