The vulnerability is a missing authorization check in the Chromoting component of Google Chrome on macOS. Before version 157 0 8103.38, a local attacker could trigger the Chromoting service from a local program and obtain sensitive information stored in the browser. The flaw allows the attacker to read private browser data without any user authentication, which could lead to privacy violations or credential leakage.

Google Chrome running on macOS. Any installation of Chrome prior to version 157 0 8103.38 on Mac is vulnerable. The issue specifically affects the Chromoting feature in the browser.

The flaw is local in scope; the attacker must have local code execution or be able to run a program on the target machine. No remote trigger is described. Because access is limited to local users, the overall risk is medium. The analysis notes that there is no EPSS data and the vulnerability is not listed in CISA KEV, indicating it may not yet be actively exploited in the wild. Updating to Chrome 157 0 8103.38 or newer removes the vulnerability, while disabling Chromoting offers a workaround.