Chrome’s FileSystem API contained an incorrect authorization check that allowed a remote attacker to gain code execution privileges beyond the browser sandbox. The flaw could be triggered by a crafted HTML page presented to the user, typically through social engineering, giving the attacker a way to run arbitrary code on the system. The vulnerability is classified as high severity by Chromium’s security team.

Google Chrome versions before 155.0.8059.39 are affected. This includes all stable-channel releases of Chrome that have not yet been updated to patch the authorization logic in FileSystem.

The vulnerability relies on a user visiting a malicious HTML file, so the attacker must first convince the user to load the page; the attack vector is therefore indirect and requires social engineering. The CVSS score of 9.6 indicates severe impact, and Chromium labels the issue as high severity. The flaw is not currently listed as a Known Exploited Vulnerability and no exploit code has been made public, making exploitation difficult but not impossible for determined adversaries.