Chrome’s networking component had a flaw that enabled a remote attacker to read sensitive data via a specially crafted HTML page. The vulnerability allows leakage of confidential information without requiring user authentication or elevated privileges, resulting in an information‑disclosure impact that could compromise user privacy and organizational data. Classified as Low by Chromium’s security severity assessment, the flaw poses a minimal threat to confidentiality.

The vulnerability affects Google Chrome versions older than 154.0.8037.57 on desktop operating systems. Users running those releases may be exposed to data leaks when they view malicious web pages or processed HTML content delivered over the internet.

A threat actor can exploit the flaw by hosting a crafted HTML page accessible to the victim. The page can trigger the information leak without authentication, making every user who visits it vulnerable. The CVSS score of 6.5 reflects a medium base score, but the Chromium security severity is Low, and with no EPSS value and not listed in KEV the likelihood of widespread exploitation appears low. Nonetheless, the simple attack vector enables actors to launch targeted attacks efficiently.