Chromium’s sync component had an incorrect authorization check that allows a remote attacker to craft network messages to the sync service and read data that should be restricted. The flaw does not lead to code execution or privilege escalation; it is a confidentiality vulnerability that can expose browsing history, passwords, and user settings.

Google Chrome installations running version 155.0.8059.38 or earlier are vulnerable. Version 155.0.8059.39 and later include the fix.

The CVSS score of 5.9 indicates a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers must send crafted traffic to the victim’s Chrome sync service, likely over the local network, VPN, or a proxy. Based on the description, it is inferred that a network‑based attack vector is required for exploitation.