The vulnerability is a confused deputy flaw in Chrome's DeviceBoundSessionCredentials component. It enables a malicious webpage to trick the browser into using a credential that is bound to a different origin, causing the browser to bypass its web origin policy. The flaw can allow a crafted page to access resources it would normally be barred from, potentially leading to data disclosure or unauthorized modification of information across origins.

Google Chrome versions prior to 155.0.8059.39 are vulnerable. The issue applies to all operating systems running any build of Chrome up to that number, until the fix in Chrome 155.0.8059.39 is installed.

Chromium rates the issue as Low severity with a CVSS score of 4.3, the EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV. The attack vector requires an attacker to host a crafted HTML page that a user visits. Because the flaw manipulates credential binding, an attacker could read or modify information across origins, but widespread exploitation is not documented. The low severity rating and lack of public exploits suggest the risk is moderate, yet updating promptly mitigates future threats.