The vulnerability is a confused deputy flaw in the Omnibox that allows a remote attacker to craft network traffic and cause Chrome to ignore the web origin policy, enabling access to resources whose original protection is governed by same‑origin rules. The weakness is identified as CWE-441 and is assigned a medium severity by Chromium’s security team.

Google Chrome desktop installations prior to version 155.0.8059.39 are affected, regardless of operating system.

The EPSS score is low, at less than 1% and the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is network-based, relying on the attacker’s ability to send crafted packets to a Chrome instance. Because the flaw permits a policy bypass without requiring local execution privileges, the CVSS score of 6.5 indicates a medium risk to affected users, warranting prompt mitigation.