A permission bypass flaw in Google Chrome before version 155.0.8059.39 allows a remote attacker to use a crafted HTML page to circumvent the browser’s site isolation boundary, thereby exposing data belonging to other sites. This vulnerability enables the attacker to read sensitive information that should be confined to its own origin and can result in privacy violations. The Chromium project has rated the severity of the flaw as low, indicating that while the impact is limited to information disclosure, it is not categorized as a high‑risk vulnerability in terms of exploitation complexity or damage potential.

The flaw affects all instances of Google Chrome that are older than version 155.0.8059.39. Users running the stable channel of the browser before this release are susceptible, regardless of operating system. Any device that has not yet upgraded to a patched version is at risk.

Because the attack vector requires only a malicious web page, it is a remote client‑side attack that can be performed over the Internet. The EPSS score is < 1%, suggesting a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, which suggests that widespread exploitation has not yet been observed. The Chromium severity rating of low and the absence of known exploits indicate a low likelihood of immediate malicious use. However, because the vulnerability permits data leakage, it remains a concern for users who rely on strong isolation between browser tabs and sites. Additionally, the CVSS score of 9.6 indicates high overall risk.