Based on the description, it is inferred that the vulnerability arises from Chrome’s DataTransfer API handling in versions prior to 154.0.8037.57. A remote attacker who has already compromised the renderer process can use a specially crafted HTML page to access sensitive data transferred via the DataTransfer object, resulting in information disclosure. The flaw maps to CWE-200: Information Exposure.

Google Chrome browsers running any build older than 154.0.8037.57, including desktop versions of the stable channel. The vulnerability is limited to systems where an attacker has already compromised the renderer process or can trick a user into loading malicious content.

Based on the description, the likely attack vector requires a foothold in the renderer process, which may be achieved through prior compromise or social engineering. Once that foothold is secured, an attacker can use a crafted page to read DataTransfer contents, leading to a moderate risk with a CVSS score of 5.3. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, indicating no widespread exploitation is known. The limited scope reduces overall risk but still concerns users handling sensitive data.