The vulnerability arises from an incorrect authorization in Chrome’s Picture‑in‑Picture feature that corrupts the web origin policy. A remote attacker can engineer a simple HTML page and use social engineering to mislead a user into opening it, thereby allowing that attacker to bypass the browser’s origin restriction and access data or resources that should be isolated by origin. The weakness is identified as CWE‑863, improper authorization, and CWE‑346, which is related to originating an unexpected authority. The impact is confined to the user's browser session but can enable credential theft, data exfiltration or further web‑based attacks if sensitive content is read or manipulated.

Affected browsers are Google Chrome versions prior to 154.0.8037.57. No other vendor hits are reported, and specific patch versions beyond the mentioned release are not provided. Users should verify that their Chrome installation is at least 154.0.8037.57 or later.

The CVSS score is 4.3, indicating low severity. EPSS score is 0.00235 and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw can be triggered with a single crafted HTML page and relies on social engineering to get the user to open it, exploitation is straightforward once the user visits the page. While the severity score is low, the possibility to read privileged content justifies prompt remediation.