A missing authorization check in the FullScreen API of Google Chrome allows a remote attacker who has already compromised a renderer process to bypass system access restrictions via a visually deceptive HTML page. Classified as CWE‑862, the flaw lets an attacker force a full‑screen request without the usual user interaction, effectively elevating local privileges and accessing resources that should otherwise be protected by the operating system. The vulnerability is considered of medium severity because it requires a renderer compromise and successful social engineering to present a malicious request.

The issue affects Google Chrome versions earlier than 155.0.8059.39. Users running these versions of the Chrome browser are vulnerable until a patched build is installed; all later stable releases contain the fix.

The EPSS score is <1 % and the vulnerability is not listed in CISA KEV, so overall exploit expectation appears moderate. Exploitation still requires a renderer compromise and successful social engineering to present a malicious full‑screen request. Once those steps are achieved, the attacker can elevate local privileges and potentially access sensitive system resources. The CVSS score of 8.3 classifies this flaw as high severity, emphasizing the criticality of timely remediation.