Missing authorization in Contextual Tasks of Google Chrome prior to 154.0.8037.57 lets a remote attacker craft an HTML page that bypasses the browser's web origin policy. The flaw can be exploited from a web page loaded in the browser, allowing the attacker to read or modify content across origins, thereby exposing user data or enabling cross‑origin attacks. The vulnerability involves missing authorization checks (CWE‑346) and an insufficient authorization check (CWE‑862), and has been rated as Medium severity by Chromium security reviewers.

All installations of Google Chrome that use a version older than 154.0.8037.57 are affected. This includes any Chrome desktop release prior to the 154.0.8037.57 patch. No other vendors or products are listed as impacted in the available data.

No EPSS score is available for this vulnerability, and it is not listed in CISA's KEV catalog, suggesting no known widespread exploitation to date. However, the flaw can be triggered by any maliciously crafted HTML page served over the network, meaning a remote attacker could exploit it simply by visiting a compromised site. Because the attack requires only the user to load a page and the vulnerability is not mitigated by network controls, the risk for exposed systems remains moderate to high until the patch is applied.