The vulnerability is an incorrect authorization check in the PermissionElement component of Google Chrome. A crafted HTML page could trick the browser into granting permissions that would normally be restricted, enabling a remote attacker to bypass the web origin policy. The weakness is classified as CWE‑863, an authorization flaw that can lead to unauthorized access to protected resources.

Google Chrome versions prior to 155.0.8059.39 are affected. The vulnerability exists in the standard desktop release of Chrome before the 155.0.8059.39 update.

The EPSS score is still negligible (< 1%), and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 6.5, indicating a medium severity vulnerability. The likely attack vector is remote, requiring a malicious web page that serves a crafted HTML payload to a user’s browser. If exploited, the attacker could breach cross‑origin restrictions and access or tamper with data originating from other domains. While the risk remains moderate, the potential damage to confidentiality and integrity justifies prompt attention.