This vulnerability represents a missing authorization check in Chrome's FileSystem implementation. A remote attacker who has already compromised a renderer process could serve a specially crafted HTML page that bypasses the browser's web‑origin policy, potentially allowing the attacker to access or modify resources across origins. The weakness is a classic example of lack of proper access control (CWE‑862).

Any desktop installations of Google Chrome older than version 155.0.8059.39 are affected, regardless of operating system. The vulnerability is tied to the 'FileSystem' API used by web applications.

The CVE is rated high by CVSS (score 8.2) and is not listed in CISA's KEV catalog, while Chromium's internal severity assessment is medium. The EPSS score is < 1%. Exploitation requires a compromised renderer, which is a significant precondition, but once achieved the attacker can bypass origin restrictions. Given these factors, the overall risk is moderate and patching is recommended as soon as possible.