A discrepancy in the animation handling in Google Chrome versions prior to 155.0.8059.39 can allow a remote attacker to obtain cross‑origin data through a crafted HTML page. The vulnerability is classified as a medium severity risk by Chromium team and corresponds to the weakness type CWE‑203, which involves improper validation or processing of untrusted input.

The affected product is Google Chrome up to, but not including, version 155.0.8059.39. All earlier releases that use the vulnerable animation code are considered at risk.

The exploitability data indicates no EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting that the known exploitation probability is modest. The attack vector is inferred to be a remote web page containing specially crafted content that triggers the animation flaw; it would require a victim to load the page in the vulnerable browser. Due to the lack of publicly reported exploits and the CVSS score of 3.1 indicating a medium severity, the likelihood of widespread exploitation is low to moderate, but users should still consider upgrading promptly.