Google Chrome versions prior to 155.0.8059.39 allow an attacker to bypass the SignIn authorization flow and gain access to sensitive user information through a malicious Chrome extension. The vulnerability is rooted in an authorization flaw classified as CWE-862, which can lead to unintended disclosure of private data. The impact is the possible acquisition of credentials or other confidential information stored by the user within the browser.

Affected users are those running Google Chrome on desktop platforms before version 155.0.8059.39. The issue is applicable to all Chrome releases in the stable channel that have not received the 155.0.8059.39 update and any corresponding security patches applied after this version.

The exploitation likely requires the user to install a crafted Chrome extension, implying a social engineering component. The CVSS score is 6.5 and the EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog. Chromium categorizes the issue as low severity, but the CVSS score indicates a medium severity per the CVSS v3 scale, suggesting that while the attack vector is possible, it may be limited by user interaction and extensions restrictions. Nonetheless, the potential for sensitive data leakage warrants prompt action.