An incomplete cleanup in the Glic component of Google Chrome versions prior to 155.0.8059.39 exposed the browser to a cross-origin data leak. A remote attacker can craft an HTML page and, using social engineering techniques, trick a user into loading it, allowing the attacker to read data from a site in another origin that the user is already authenticated with. The weakness is classified as CWE-459 (Insecure Temporary Storage). The result is the unauthorized disclosure of private information that may have been stored in a different domain, potentially impacting user confidentiality.

Google Chrome browsers with a version earlier than 155.0.8059.39 are affected. This vulnerability would apply to all users running these older builds.

The Chromium project lists this issue as Low severity, with a CVSS score of 4.3; no EPSS score is available. It is not included in the CISA KEV catalog. Exploitation requires the user to visit a maliciously crafted page, which typically relies on social engineering. While the exploitation probability is uncertain, the potential to obtain cross-origin data warrants timely remediation.