Cross-origin data disclosure is a security flaw that lets data from one web origin be read by another site, extension, or component that should not have access to it. The protected boundary is the browser’s same-origin policy, which is meant to stop one site from seeing another site’s cookies, page content, messages, or internal API responses.
This matters because browsers and extensions often handle sensitive information across many websites. If origin checks are missing or weak, a malicious page may trigger privileged logic and extract data from a different site, even though the user only visited a harmless-looking link. Defenders look for strict origin validation, least-privilege extension permissions, and careful message handling. In practice, this flaw can turn trusted browser features into a data-leak path without compromising the target service itself.