The vulnerability is a missing authorization check in Chrome’s Network component that allows a remote attacker who has already compromised the renderer process to bypass site isolation. The attacker can craft a malicious HTML page that loads into the compromised renderer, effectively leaking information from other website contexts and potentially executing privileged code in the browser. The weakness identified is a missing access control (CWE‑862) that directly enables the bypass.

Google Chrome users running versions earlier than 155.0.8059.39 are affected. The vulnerability applies to the stable channel of Chrome on all platforms supported by Google Chrome. Specific product details are limited to the Chrome browser itself, with no additional components identified.

The EPSS score is < 1% and the CVSS score of 6.5 indicates a medium severity, while the vulnerability is not listed in the CISA KEV catalog. This combination suggests that, although the risk is moderate, exploitation is unlikely to be widely used. The attack requires local compromise of the renderer process, meaning it is primarily a local privilege escalation within the browser environment. Users should view it as a moderate‑to‑high in‑browser privilege escalation risk and apply the fix promptly.