Improper privilege management in the Chrome user interface on macOS enables a remote attacker to bypass system access restrictions by delivering a crafted HTML page. The vulnerability requires social engineering; a user must interact with the malicious page for the attacker to benefit. The impact is limited to situations where the user opens the page, as no remote code execution or persistent compromise is described. It is classified as low severity by Chromium, indicating a modest risk when exploited in this manner.

Google Chrome running on macOS earlier than version 155.0.8059.39 is affected. Users of older Chrome releases on Mac must verify their version and consider upgrading.

The CVSS score of 5.4 indicates low severity, and the EPSS score of < 1% indicates a very low probability of exploitation. The attack vector is inferred to rely on a user interacting with a malicious HTML document, meaning it is a user-interaction prerequisite. Because it is not listed in the CISA KEV catalog, there is currently no evidence of exploitation in the wild. However, the vulnerability permits an attacker to privilege‑escalate within the browser context, potentially leading to sensitive data exposure or unintended system actions if the user proceeds.