This vulnerability stems from an incomplete cleanup in the Chromoting component of Google Chrome on macOS. A remote attacker can send specially crafted network traffic to a Chrome instance that has not performed proper resource deallocation, allowing the attacker to bypass the OS‑level system access restrictions normally enforced by the browser. The flaw is categorized as CWE‑459 (Incomplete Cleanup). Because the attacker can interact with the network layer of the running Chrome process, the impact could include elevated privileges or unauthorized actions on the host system while the browser is running.

Google Chrome for macOS versions prior to 155.0.8059.39. Based on the description, it is inferred that Windows and Linux versions are not affected, but this inference is not explicitly stated in the CVE data.

The EPSS score indicates an exploitation probability of less than 1%, and the CVSS score of 9.1 signifies a high severity, yet the CVE is not listed in the CISA KEV catalog. The Chrome security team classifies the vulnerability as Low severity, indicating that while exploitation could lead to privilege escalation, the susceptibility window is narrow and requires remote interaction with a victim’s browser instance. The attack vector, inferred from the description, is network‑based and requires the victim to have an active Chrome session that has not yet been cleaned up by the Chromoting component.