A flaw in Chrome’s editing feature permits a remote attacker to obtain sensitive browser contents by delivering a crafted HTML page that exploits the edit mode. The vulnerability, classified as CWE‑200, can reveal session tokens, local storage data, or other information that the browser has cached. A user who opens the malicious page may have confidential data transmitted to the attacker without needing system privileges.

All users of Google Chrome versions earlier than 155.0.8059.39, regardless of operating system, are affected because the edit feature behaves identically across Windows, macOS, and Linux.

The CVSS score is 4.3, indicating a moderate impact. EPSS is not available, so the current exploitation likelihood is unknown, and the issue is not listed in the CISA KEV catalog. The attack vector is likely social engineering: the victim must intentionally load a malicious HTML file or navigate to a compromised web page. If successful, the attacker can pull data from the victim’s browser context, potentially leading to credential theft or privacy violations.