A race condition in Chrome's Network component permits a remote attacker that has already compromised the renderer process to retrieve data from a different origin by serving a specially crafted HTML page. The flaw is a classic time‑of‑check/time‑of‑use issue that allows the attacker to read network‑level data that should be restricted by same‑origin policy. Although the CVSS score is 3.1, the vulnerability is classified with a high security severity as it enables disclosure of confidential information.

The affected vendor is Google Chrome. Versions prior to 153.0.8010.47 are vulnerable, including all stable channel releases before the 153.0.8010.47 update.

With a CVSS score of 3.1 and an EPSS score of less than 1%, exploitation is unlikely to occur in the wild and the vulnerability is not listed in the KEV catalog. The attack requires an attacker who can already compromise the renderer process, typically via a malicious web page or compromised content. If the renderer is compromised, the race condition can be used to read cross‑origin data, but no remote code execution or denial of service effect is reported. Start by evaluating how often the renderer can be brought into a compromised state in your environment.