Missing authorization checks in the DataTransfer API in Chrome versions before 155.0.8059.39 allow an attacker who has already gained control of a renderer process to read sensitive data from DataTransfer objects via a crafted web page. This flaw bypasses Chrome’s privacy controls for clipboard and drag‑and‑drop data, exposing private information such as user input, clipboard contents, or other sensitive data that should be protected. The result is unauthorized access to confidential information from a compromised render context.

Chrome installations running any version earlier than 155.0.8059.39 are vulnerable. The issue applies to all Chrome builds across operating systems that use the affected engine version, including Windows, macOS, Linux, and mobile platforms. Users who have not applied the latest update are at risk if the renderer process can be compromised.

The CVSS score of 5.3 indicates a medium severity risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so no publicly documented exploits are known. Based on the description, it is inferred that an attacker must first gain control of a renderer process, likely through a separate vulnerability such as cross‑site scripting, before abusing the unprotected DataTransfer API. Therefore, the exploitation path is non‑trivial, but the moderate CVSS rating and lack of known exploits suggest moderate risk for users who have not applied the update.