Google Chrome contains an incorrect authorization flaw that permits a remote attacker, once they have compromised the renderer process, to bypass system access restrictions by serving a crafted HTML page. The defect lies in Core and is designated as a high‑severity issue in Chromium’s assessment. Because the vulnerability allows a compromised renderer to elevate its privileges and access protected system resources, it can lead to unauthorized file reads or writes, potentially exposing sensitive data or enabling further compromise.

Google Chrome users of any release prior to version 155.0.8059.39 are affected. The flaw is present in Chromium builds that have not received the 155.0.8059.39 update, so all earlier Chrome versions are impacted.

The CVSS score of 8.3 indicates high severity; the EPSS score is < 1% and the vulnerability remains unlisted in the CISA KEV catalog. Exploitation requires the attacker to have already compromised the renderer process, implying that the vulnerability is most dangerous in situations where malware or a malicious site has already gained control of the browser’s rendering engine. Given the lack of a known public exploit and the need for a pre‑existing compromise, the practical risk is moderate, but the potential for privilege escalation remains significant.