Improper privilege management in Mojo, a component of Google Chrome, allows a local attacker on Windows to gain higher privileges and run arbitrary code outside the browser’s sandbox. The flaw is based on CWE-269 and has a documented high severity rating by Chromium’s internal scoring.

Google Chrome for Windows versions prior to 154.0.8037.92 are affected. All installations of these versions run with standard user privileges that can be elevated by a malicious local program.

The CVSS score of 8.6 indicates high risk. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been observed in widespread exploitation. The attack requires local access and a malicious program already running on the target system; thus the typical vector is a local attacker who can execute code on the machine.