An incorrect authorization check in Chrome DevTools allows a remote attacker to leverage social engineering to leak cross‑origin data through a crafted HTML page. The vulnerability is a broken access control flaw (CWE-863) that permits the attacker to read data from other origins that the user has loaded. The primary impact is the disclosure of sensitive information, but it does not enable remote code execution or direct system compromise.

Google Chrome desktop builds older than 155.0.8059.39 are affected. Any user running a vulnerable Chrome version on Windows, macOS, or Linux may be exposed to the data‑leak attack if they visit a malicious page that triggers DevTools.

The flaw carries a CVSS score of 4.3, indicating low severity, and is not listed in the CISA KEV catalog. EPSS data is unavailable, suggesting little public exploitation. The attack vector is remote, requiring the victim to load a malicious web page that prompts DevTools access via social engineering. Exploitation depends on user interaction and does not involve code execution.