The vulnerability originates from incorrect authorization control in Chrome's GetUserMedia implementation. When a renderer process is compromised, an attacker can exploit a crafted HTML page that bypasses system access restrictions intended to isolate the renderer. The attack path allows the attacker to access privileged media APIs without proper user consent, potentially giving elevated privileges or access to protected system resources. This flaw is identified as CWE-863, reflecting the failure to enforce correct authorization checks. The severity reported by Chromium is medium.

The weakness exists in Google Chrome versions prior to 155.0.8059.39. Users running any version of Chrome that predates this patch are susceptible. The affected component is the browser’s renderer process handling media capture requests.

The vulnerability is rated with a CVSS score of 6.5, indicating medium severity, but exploitability depends on prior compromise of the renderer process, which is a high‑bar prerequisite. The EPSS score is < 1%, suggesting a very low likelihood of current exploitation, and the issue is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Once the renderer is compromised, the crafted HTML page can trigger the GetUserMedia API with elevated privileges. Attackers would need to establish a foothold that gives them renderer execution, then serve malicious content to trigger the flaw.