Technical impact
The vulnerability arises from improper certificate validation in the FedCM feature of Google Chrome. An attacker can craft network traffic that tricks the browser into treating a malicious site as a trusted origin, enabling a web origin policy bypass. This weakness, identified as CWE‑295, could allow an attacker to perform actions normally restricted by same‑origin rules, potentially exposing sensitive data or phishing users, though no system‑wide compromise is directly supported.
Affected Systems
All users running Google Chrome versions earlier than 153.0.8010.36 are vulnerable. The issue affects the stable channel and any release that predates the fixed patch. This includes all desktop operating systems where Chrome is installed.
Risk and Exploitability
The CVSS score is 7.5, indicating high severity, while the EPSS score is below 1%, reflecting a very low exploitation probability. The vulnerability is low an attacker to deliver crafted network traffic, often through social engineering, to a victim who interacts with the target. Because the issue is not listed in CISA KEV and the exploitation vector is user‑initiated, the overall risk to the broader community remains low, but users should still mitigate by updating.
Debian DLA
Debian DSA