The flaw is an incorrect authorization in the Scheduling module of Google Chrome prior to version 155.0.8059.39. It permits a remote attacker to bypass the browser’s web origin policy by loading a specially crafted HTML page, potentially allowing cross‑origin that the page did not intend. The weakness is categorized as Improper Authorization (CWE‑863), and could lead to data leakage, unauthorized script execution, or other malicious cross‑origin payloads.

Affected systems are Chromium‑based browsers released under Google Chrome’s stable channel before update 155.0.8059.39. Users running any earlier release of Chrome on Windows, macOS, Linux, or Android are susceptible, regardless of their configuration or network environment.

The report rates the issue as low severity with a CVSS score of 4.3, indicating a modest impact. The vulnerability can be exploited remotely via a crafted HTML page delivered over the network, and the attacker requires only to entice a victim to open the page. While the EPSS score of < 1% indicates a very low probability of exploitation, the vulnerability is not listed in CISA KEV, the lack of mitigation information suggests that the attack remains feasible with a modest probability. Administrators should treat the risk as low to moderate until a patch is applied.