The vulnerability is a use‑of‑released‑resource flaw in Chrome’s core that allows a remote attacker who has already compromised the renderer process to read data from cross‑origin pages via a crafted HTML page. This can lead to unauthorized disclosure of sensitive information but does not provide code execution or privilege escalation.

Google Chrome users running versions older than 155.0.8059.39 are potentially affected. The flaw resides in core components that handle resource cleanup after rendering, and any desktop Chrome installation that has not been updated to the 155.0.8059.39 release or later may be vulnerable.

The exploit requires a pre‑existing compromise of the renderer, limiting the attack surface to environments where an attacker can inject malicious HTML into the compromised renderer. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating a lower likelihood of widespread exploitation. The CVSS score of 3.1 classifies this issue as low severity, reinforcing the assessment of limited impact. Chromium’s internal severity is low.