Google Chrome apparently contains a flaw where a malicious renderer process can bypass system access restrictions to load fonts that should otherwise be protected. The weakness is an incorrect authorization check in the FontAccess feature (CWE‑863). The vulnerability permits a crafted HTML page to trigger the renderer to access protected system fonts once the renderer process has already been compromised.

The flaw affects all Chrome installations running versions prior to 155.0.8059.39, including Windows, macOS, and Linux desktop builds that use the same FontAccess implementation.

The CVSS score of 6.5 denotes moderate severity, while the EPSS score of <1% suggests a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Successful exploitation requires the attacker to first compromise the renderer process, which is generally limited by Chrome’s sandboxing. After that, the attacker can read and load system fonts that should have been restricted.