Cross-site data exposure is a web security flaw that allows information from one site, origin, or browser context to leak into another. The exposed data may include page content, session details, API responses, cached objects, or user-specific information that should stay isolated.
This matters because modern browsers enforce the same-origin policy to keep sites separated. When that isolation fails, an attacker can sometimes read sensitive data from another origin through a script bug, misconfigured CORS policy, improper caching, shared storage, or a browser vulnerability. In real attacks, this can turn a harmless-looking webpage into a data theft channel. Defenders look for strict origin checks, safe cache handling, correct access-control headers, and reduced cross-site sharing of secrets. In browser security updates, cross-site data exposure is a common class of issue because even a small leak can reveal tokens, private content, or account data.