The vulnerability arises from improper certificate validation in the Loader component of Google Chrome. An attacker who can drive the browser to process crafted network traffic can cause the browser to accept an invalid certificate. This leads to the browser treating traffic from an untrusted issuer as trusted and bypassing the web origin policy. The bypass enables a malicious site to read or write data across origins, potentially stealing data or injecting malicious content. The CVE lists the severity as low, but the impact on confidentiality and integrity can be significant depending on the context.

Google Chrome is affected. The issue exists in all versions prior to 153.0.8010.36. No specific patch version was supplied, but updating to 153.0.8010.36 or later resolves the issue.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The unspecified CVSS severity and lack of a public exploit suggest that exploitation is likely low‑probability and requires an attack that can deliver malicious network traffic to a victim’s browser. Because the vulnerability is triggered by crafted network traffic and involves certificate handling, the attack vector is inferred to be network‑bound, possibly via phishing or a malicious website that encourages users to visit a specially crafted URL. Without a public exploit, the risk remains low, but the potential for origin‑policy bypass warrants patching.