A race condition in the WebAudio component of Google Chrome allows a remote attacker to craft an HTML page that can leak cross‑origin audio buffer data. The vulnerability enables the attacker to read confidential information that was originally protected by the same‑origin policy, potentially exposing sensitive audio or other data contained in the browser context.

Google Chrome versions prior to 155.0.8059.39 are affected. Only the stable Chrome browser is listed as a target; no other Google products are indicated.

The vulnerability is medium‑severity according to Chromium’s assessment. Attackers would need to deliver a malicious web page to the victim’s browser and exploit the race condition to read audio buffers. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, indicating it is not known to be actively exploited in the wild as of this analysis. However, the possibility of cross‑origin data leakage warrants prompt attention, especially for users handling sensitive information in Chrome.