An attacker can exploit a flaw in Chrome’s reference handling to cause the browser to resolve a crafted file reference incorrectly, allowing the attacker to read data from a domain that the user does not have permission to access. The vulnerability is primarily a confidentiality issue and aligns with CWE-706, Access Control Via Improper Authorization. Based on Chromium's Low severity rating, it is inferred that the impact is limited to data leakage rather than arbitrary code execution or denial of service.

Google Chrome is affected on all versions dated prior to 155.0.8059.39. Users running any earlier patch level of the stable channel are vulnerable and should be updated to the mentioned or later builds.

Because the exploit requires the user to open a specially crafted HTML page, the attack vector is social‑engineering. It is inferred that no public exploit code or tool exists, and given that the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the likelihood of a large‑scale attack appears low. Based on Chromium's Low severity rating, it is inferred that the likelihood of mass exploitation is minimal, yet a compromised user could leak sensitive cross‑origin data. The CVSS score of 4.3 confirms this low severity assessment. The overall risk is therefore medium to low, but patching remains the definitive mitigation.