Improper input validation in Chrome’s WebAudio API permits a crafted HTML page to bypass system access restrictions once the renderer process has already been compromised. The flaw enables the attacker to elevate privileges within the confined renderer environment, potentially accessing protected resources that the browser normally limits. Although the Chromium security severity is low, it still represents an avenue for privilege escalation if the renderer is first compromised.

Google Chrome versions earlier than 155.0.8059.39 are affected. The vulnerability applies to all operating environments where Chrome is installed, provided the legacy builds are in use.

The flaw does not allow direct remote code execution from an external source; it requires that the attacker first gain control of the renderer process, which typically occurs through another vulnerability or social engineering. The CVSS score of 5.4 indicates moderate severity, and the EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Nonetheless, once the renderer is compromised, the attacker can bypass system-level restrictions within the browser context.