A flaw in Chrome’s Scroll authorization allowed attackers to create a crafted HTML page that could read data from a different origin. The vulnerability is not a code‑execution flaw but enables remote information disclosure. Users must be lured to a malicious page, after which the attacker can exfiltrate sensitive data visible to the browser. The affected process is a single user’s browser session, and the impact is limited to data leakage, not system compromise.

Google Chrome versions prior to 154.0.8037.57 are affected. The flaw exists only in the desktop stable channel before this patch release.

The CVSS score of 4.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. The attack vector is inferred to be a social‑engineering click on a crafted page; no additional privileges are required. While exposure is user‑dependent, the potential for data leakage makes patching advisable.