Missing authorization in Google Chrome allows a remote attacker to bypass system access restrictions by delivering a crafted HTML page that the user might open through social engineering. An attacker could potentially gain elevated privileges or launch additional payloads on the user’s machine. The flaw is classified as an authorization bypass, which could compromise the confidentiality, integrity, or availability of the user’s data.

Google Chrome versions earlier than 155.0.8059.39 are affected. The issue exists in the stable channel of the desktop browser.

The vulnerability is rated as low severity with a CVSS base score of 5.4. EPSS score is <1% and it is not listed in the CISA KEV catalog, so the known exploitation probability is unclear. However, the exploit requires a social‑engineering step to trick the user into loading a malicious HTML page, which may reduce the likelihood of widespread exploitation but still warrants prompt remediation if users encounter suspicious content.