Google Chrome previously contained an incorrect authorization check in an internal API that allowed a remote attacker to defeat the web origin policy by loading a specially crafted HTML page. If an attacker could host such a page, the vulnerability could let them access or tamper with web content that should be restricted to a different origin, potentially leaking or modifying sensitive data. The Chromium security team rated the severity for this issue as Low.

The flaw existed in Google Chrome versions earlier than 155.0.8059.39. All users running any of those releases were vulnerable until the fix was distributed in subsequent stable releases.

The CVSS score is 4.3 and the EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation at this time. Based on the description, the likely attack vector is a crafted webpage that the attacker serves to a victim’s browser; no additional network privilege or compromise of the host system is required to trigger the API call. Consequently, the risk remains comparatively low, but it is still advisable to patch to avoid potential abuse.