An observable discrepancy in the Network subsystem of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to obtain cross‑origin data by serving a crafted HTML page. The flaw is an information‑disclosure weakness that lets the browser reveal data that should remain isolated to another origin, potentially exposing sensitive user information. The weakness is classified as CWE‑203.

Google Chrome web browser versions prior to 153.0.8010.36 are affected. The vulnerability exists in the stable channel releases shipped by Google and applies to all platforms that use these versions.

The vulnerability is rated as low severity with a CVSS score of 3.1 and is not listed in the CISA KEV catalog. The EPSS score is less than 1%, indicating a very low probability of exploitation. Exploitation requires only that a malicious webpage be delivered to a user running the affected Chrome version; no special privileges or complex prerequisites are needed. The risk remains moderate until the vendor releases an official fix, at which point the attack surface will be closed.