The vulnerability in Google Chrome's ReadingMode allows a remote attacker who has already compromised the renderer process and used social engineering to serve a specially crafted HTML page to bypass site isolation. This missing authorization means the attacker could potentially access data or resources that should be protected by cross‑origin boundaries, increasing the risk of data exposure and privilege escalation. The flaw is categorized as an access‑control weakness (CWE‑862).

The issue affects Google Chrome browsers running versions before 155.0.8059.79. The fix is present in version 155.0.8059.79 and later.

The CVSS score of 4.2 indicates a low to moderate severity, and the EPSS score below 1 % suggests that exploitation is unlikely at present. Based on the description, it is inferred that the attack requires an attacker to first gain control over the renderer process, and therefore actively exploiting this flaw would be difficult and would need further social engineering to deliver the malicious page. The vulnerability is not listed in CISA’s KEV catalog.