Google Chrome versions prior to 154.0.8037.57 allow a remote attacker who has already compromised the renderer process to retrieve data from other origins through a crafted HTML page. The flaw enables cross‑origin information disclosure that can leak private user data or browser state. Based on the description, it is inferred that the attacker must first compromise the renderer process, which can occur through malicious web content or a compromised extension, before exploiting the information leak.

Google Chrome is affected, specifically releases before 154.0.8037.57. Users running any earlier stable channel version are vulnerable.

The CVSS score of 3.1 indicates a low impact. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting a lower likelihood of widespread exploitation. It is inferred that the attacker must already have compromised the renderer process, which typically requires exploiting another vulnerability or employing social engineering to gain initial access. Once renderer compromise is achieved, the attacker can leverage the crafted HTML page to read cross‑origin data.