The vulnerability is a missing authorization check in the Actor component of Google Chrome. A remote attacker who has already compromised the renderer process can trigger actors to run with elevated privileges, enabling execution of arbitrary code outside the normal sandbox and potentially allowing full system compromise. The weakness is classified as CWE‑862 and the Chromium team has rated its internal severity as low.

All Google Chrome installations running versions earlier than 155.0.8059.39 are affected. The flaw manifests in the renderer process on Windows, macOS, Linux, Android, and iOS builds that have not been updated to the listed version.

No EPSS score is reported and the vulnerability is not listed in CISA KEV. The CVSS score of 8.3 indicates high severity, yet the impact of remote code execution is inherently high. The realistic exploitation pathway requires the attacker to first compromise the renderer process, which typically means delivering a malicious web page or having another component with already installed privileges. The overall risk can be considered moderate to high for environments that allow untrusted web content without additional security controls. Inference: The likely attack vector involves a privileged renderer process interacting with a crafted web page that invokes the vulnerable Actor.