An incorrect authorization check in Google Chrome extensions allowed a remote attacker to craft a malicious extension that could read data from websites the user visited that were from different origins. The vulnerability could let an attacker obtain confidential information without the user’s knowledge. The weakness stems from a permissions mis‑interpretation, classified as CWE‑863.

Google Chrome versions prior to 155.0.8059.39 are affected. Users running any older build of the stable channel are at risk until they upgrade to 155.0.8059.39 or later.

The overall severity, reflected by a CVSS score of 4.3, is rated medium by Chromium reviewers. No exploit probability score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to convince the user to install a crafted extension, which is a remote attack vector. When an extension with such privileges is installed, the attacker can read or transmit cross‑origin data freely, creating a potential confidentiality breach. If left unpatched, the risk remains moderate due to the need for user interaction.