An extension in Google Chrome prior to version 155.0.8059.39 can be triggered by a specially crafted HTML page, allowing a remote attacker to read data that would normally be protected by the browser’s same‑origin policy. The vulnerability enables the attacker to exfiltrate confidential cross‑origin information, undermining the confidentiality of the victim’s browsing session. The weakness is classified as CWE‑668, improper resource exposure.

All users of Google Chrome versions earlier than 155.0.8059.39. The issue is confined to the browser’s extensions framework and does not affect other Google products.

The vulnerability has no available EPSS score and is not listed in the CISA KEV catalog, and its CVSS score of 4.3 places it in the Medium severity range. The likely attack path involves a user visiting a malicious web page that exploits the vulnerable extension, which then reads cross‑origin data. Though the exploitation probability is uncertain, the medium severity indicates potential for significant data leakage, warranting timely remediation.