The vulnerability resides in the Cross‑Origin Resource Sharing implementation of Google Chrome versions prior to 155.0.8059.39. It causes information loss that enables a remote attacker, by sending crafted network traffic, to circumvent the browser’s origin policy and read data across isolated origins. The weakness is classified as CWE‑221 and is considered a low‑severity issue by Chromium’s internal assessment, indicating that its primary impact is confidentiality breaches rather than integrity or availability.

This issue affects all installations of Google Chrome that were built before the stable channel update 155.0.8059.39 released on October 6 2026. Any user running a pre‑155.0.8059.39 build is vulnerable, regardless of platform, as the flaw exists across the browser’s network stack.

The EPSS score is <1% and the vulnerability is not in the CISA KEV catalog, implying no documented large‑scale exploitation as of now. The CVSS score of 4.3 indicates low severity. Because the flaw can be exploited remotely via network traffic and no authentication or privilege escalation is required, it can be inferred that no such prerequisites are needed. The attack vector is therefore high; however, the overall risk remains low due to the low severity rating.