An authorization flaw exists in Google Chrome’s DevTools that permits a remote attacker with social engineering skills to craft an HTML page and potentially access data from another origin, violating the same-origin policy. The weakness, classified as CWE-863, enables the attacker to read sensitive cross‑origin information that would normally be protected by browser isolation. This flaw can compromise user data integrity and confidentiality, though it does not provide remote code execution or denial of service. The CVSS score of 4.3 reflects its moderate risk profile for the impact on confidentiality and integrity without affecting availability.

Google Chrome browsers prior to version 154.0.8037.57 are vulnerable. Users running any older stable channel edition are at risk, regardless of platform, as the issue was present uniformly across the code base.

The CVSS score of 4.3 indicates a low‑to‑moderate severity. Because the EPSS score is unavailable, the exact likelihood of exploitation remains uncertain; however, the flaw’s description notes that a social‑engineering attack is required, meaning it is not trivially exploitable. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely reported active exploitation. Nonetheless, the potential to bypass same‑origin restrictions warrants prompt remediation.