Google Chrome before version 155.0.8059.39 contained an authorization flaw in the PermissionElement component that permits a remote attacker to bypass system access restrictions by serving a specially crafted HTML page. The vulnerability is a Classic Incorrect Authorization weakness (CWE‑863). An attacker could use this bypass to execute actions or access resources that the browser should have protected, jeopardizing integrity and possibly confidentiality of user data or system settings. This flaw is rated low severity by Chromium’s internal review but still permits unauthorized operations when exploited.

The issue affects all installations of Google Chrome running any version prior to 155.0.8059.39.

The CVSS score of 5.4 classifies it as moderate severity, and the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. Because the exploit requires serving a crafted HTML page, the likely attack vector is remote, via a malicious website or email attachment that loads the vulnerable page. The moderate internal severity suggests that exploitation would require significant persistence and user interaction, but the ability to bypass permission controls warrants prompt patching.