The vulnerability arises from the use of a released resource in the FontAccess API, allowing a remote attacker who has compromised the renderer process to bypass the browser's web origin policy using a crafted HTML page. This effectively permits reading or executing resources from a different origin without permission, violating the same‑origin security boundary. The weakness is a use‑after‑free condition (CWE‑672).

Affected systems include Google Chrome browsers that are versions 155.0.8059.38 and earlier. Users or administrators of machines running any of those releases should consider patching to 155.0.8059.39 or later.

The CVSS score is 6.5 and the EPSS score is < 1%, with no listing in the CISA KEV catalog. However, the ability to bypass origin policy once the renderer process is compromised indicates a serious policy violation. The attack vector requires an attacker to control the renderer, after which a malicious HTML document that triggers FontAccess can be used to read resources across origins.