A missing authorization check within Google Lens in Google Chrome allows a remote attacker that has compromised the renderer process to retrieve cross‑origin data by loading a specially crafted HTML page. The vulnerability permits reading information from sites the user visits effectively enabling confidential data exposure. Chromium categorizes the severity as medium, reflecting a significant privacy risk but not a direct exploitation of system privileges.

Google Chrome versions prior to 155.0.8059.39 are vulnerable. The issue affects the Chrome browser on all platforms where Google Lens is enabled, and any user who has not applied the newer patch that addresses the missing authorization control.

The exploit requires a foothold in the renderer process, implying that a malicious page or script must already have breached the sandbox boundary or that the user has inadvertently installed compromised content. The CVSS score of 3.1 classifies the vulnerability as medium severity. Since the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the current market exploitation likelihood is considered low to moderate. The lack of a publicly disclosed exploit reduces immediate threat, but the potential to read cross‑origin data remains a serious privacy concern should any attacker compromise the renderer.