The vulnerability is a missing authorization check in the Permissions subsystem of Google Chrome. A remotely reachable attacker who has already compromised a renderer process can exploit this flaw by delivering a specially crafted HTML page that tricks the compromised renderer into performing privileged actions. This bypasses the intended system access restrictions and allows the attacker to carry out operations that would normally be blocked. According to Chromium, the severity of this flaw is classified as low, indicating that the attack would require additional compromise steps and targeted social engineering.

Chrome browsers whose versions precede 155.0.8059.39 are vulnerable. Any installations still running an earlier version remain at risk.

The flaw can be exploited only after an attacker first compromises the renderer process, a step that typically requires a separate vulnerability or local privileges. Once that foothold is achieved, the social‑engineering element reduces the barrier to exploit, as the attacker merely needs the user to load a crafted page. The EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog, suggesting no widespread exploitation has been observed. Nonetheless, the potential for unauthorized system access justifies applying the fix as soon as possible. The CVSS score is 5.4, indicating a moderate risk for environments where a renderer compromise is plausible.