Missing authorization in the BrowserTag component of Google Chrome before version 155.0.8059.39 allows an attacker who already controls a renderer process to bypass the browser’s isolated site boundaries by serving a crafted HTML page. This flaw enables the attacker to access or manipulate content that should be restricted to another origin, effectively elevating their privileges within the browser context. The weakness aligns with the CWE‑862 "Missing Authorization" failure mode.

All desktop builds of Google Chrome that are older than 155.0.8059.39 are affected. The vulnerability applies universally across supported operating systems, with no platform‑specific restrictions noted. Users who have not upgraded beyond the fixed release remain at risk.

The CVSS score of 4.2 indicates low overall severity. The EPSS score of less than 1% reflects a very low probability of exploitation in the wild. Exploitation requires the attacker to first compromise a renderer process, a scenario that typically demands social engineering or a separate vulnerability. Once that prerequisite is met, the attacker can craft a malicious page to lift site isolation boundaries and potentially read or modify data from otherwise isolated sites. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploitation has been reported, so the immediate risk is modest but patching remains prudent.