Insufficient validation of untrusted input in the Input component of Google Chrome allows a remote attacker who has already compromised the renderer process to deliver a crafted HTML page. The flaw is capable of reading data from origins that the page should not normally be able to access, which can expose confidential information. The weakness is summarized by CWE‑20 (Improper Input Validation).

Google Chrome versions earlier than 148.0.7778.179 are affected. The vulnerability exists in the stable channel of Chrome and applies to all operating systems that run the renderer process, since the affected component is part of the browser engine.

The CVSS score of 5.3 points to medium severity. Exploitation requires the attacker to first achieve compromise or foothold in the renderer process, which may require a separate vulnerability or privileged access. The EPSS score is not available and the flaw is not in CISA KEV, suggesting that widespread public exploitation is uncertain. Nevertheless, the attack vector remains possible for adversaries who can initially breach the renderer process.