Missing authorization in Google Lens within Google Chrome allows a remote attacker who has already compromised the renderer process to leak cross‑origin data through a crafted HTML page. The flaw enables the attacker to read data that should be protected by same origin rules, resulting in a confidential information disclosure in the host system.

Google Chrome browsers prior to version 155.0.8059.39 are affected by this vulnerability. The issue has no version interval beyond that; all earlier releases lack the fix that was introduced in 155.0.8059.39.

The vulnerability is rated medium in Chromium's security severity scale and is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score is available. Exploitation requires that the attacker already controls the renderer process, typically through a malicious web page or a compromise of the browsing environment. Because the flaw leaks cross‑origin data from Google Lens, the attack does not directly grant full system compromise but can expose sensitive information. Given the lack of public exploits, the immediate risk is moderate, but promptly applying the update is recommended to eliminate the possibility of data leakage.