Technical impact
The vulnerability arises from an inappropriate UI implementation in Google Chrome on Windows versions prior to 149.0.7827.53. It allows a local attacker who can supply a malicious file to gain higher privileges while using the browser, effectively enabling unauthorized access to system resources. The weakness is a classic input validation flaw (CWE‑20) and improper credential management (CWE‑266). This can lead to unauthorized data modification or exposure, compromising confidentiality and integrity of the local machine.
Affected Systems
Affected vendors include Google, with the Chrome browser product on Windows. Any installation of Chrome on Windows that has a version earlier than 149.0.7827.53 is susceptible to the privilege‑escalation flaw.
Risk and Exploitability
The CVE is scored at 7.8, indicating a high risk when the flaw is exploitable. EPSS score is <1%, showing a very low but nonzero exploitation probability at the time of this analysis, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local; an adversary who can drop a crafted file on the victim’s machine and trigger it via the UI can elevate privileges. Because the flaw requires local access, the attack surface is limited, but the high severity and permission escalation warrant prompt mitigation.
Debian DSA