This vulnerability is a confused deputy flaw in Chrome’s DevTools where a maliciously crafted HTML page can elevate privileges to bypass the web origin policy. A remote attacker can trick the browser into treating content from an untrusted source as if it originated from a trusted domain, giving the attacker unauthorized access to cross‑origin data or capabilities. The weakness is an improper access control issue identified as CWE‑346 and CWE‑441.

Affected vendor: Google. The issue exists in all Chrome desktop stable channel builds prior to version 154.0.8037.57, covering Windows, macOS, and Linux installations that had not applied the 2026‑09‑08 update.

The CVSS score of 4.3 indicates a low severity vulnerability, while the EPSS score of 0.00235 (≈0.235%) suggests a low likelihood of exploitation. The attack requires social engineering; the user must open a specifically crafted HTML page that leverages DevTools. Once exploited, the attacker could gain cross‑origin access to sensitive information or execute code within the victim’s page context. The vulnerability is not listed in CISA’s KEV catalog.