A cross‑site request forgery flaw in the Chrome DevTools component lets a remote attacker use a crafted HTML page to trigger requests that run in the context of a target web origin. This allows the attacker to execute actions that should be restricted by the same‑origin policy, potentially leaking sensitive data or modifying site state. The vulnerability is categorized as a Medium severity issue by Chromium security.

Google Chrome installations running versions earlier than 154.0.8037.57 are affected. No additional version details are provided beyond the stated maximum version that contains the fix.

The CVSS score of 8.8 qualifies as a High severity vulnerability. Because exploitation requires social engineering to get a user to load the crafted page and relies on the DevTools component being accessible, the likelihood of widespread automated exploitation remains low, as indicated by the EPSS score of less than 1%. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to persuade or trick users into visiting the malicious page to gain a breach of the web origin policy.