Cross-origin data access is a browser security flaw that allows code or content from one website origin to read, modify, or otherwise interact with data from another origin. It usually indicates a break in the browser’s same-origin protections, which are meant to keep sites isolated from each other even when they run in the same browser.
This matters because origins often separate sensitive data such as session tokens, private messages, account details, and internal web app content. If isolation fails, an attacker may steal information from a victim site, trigger actions as the user, or chain the bug with other vulnerabilities for broader compromise. Defenders look for strict origin checks, correct use of browser security headers, and secure handling of cross-site messaging and embedded content. In real attacks, the flaw often appears in sandbox escapes, DOM leaks, or bugs in how browsers enforce access rules between windows, frames, or service contexts.