Missing a required authorization check in the FedCM component of Google Chrome enables a remote attacker to fabricate a web page that bypasses the browser's same‑origin policy. By exploiting this flaw an attacker can read or modify data belonging to other web origins, thereby compromising user data confidentiality and integrity. The weakness is classified as CWE-862.

The vulnerability affects Google Chrome browsers prior to version 155.0.8059.39. No additional vendors or products are affected according to the data provided.

Chromium rates the issue as Medium severity with a CVSS score of 6.5. The EPSS score is < 1 %, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited evidence of exploitation. The attack vector requires the attacker to host a malicious HTML page that triggers FedCM in a user’s browser; any user who opens the page can become a victim. The missing authorization check makes the flaw relatively straightforward to abuse once the page is served.