The vulnerability arises from an inappropriate UI implementation in Google Chrome on Windows versions prior to 149.0.7827.53. It allows a local attacker who can supply a malicious file to gain higher privileges while using the browser, effectively enabling unauthorized access to system resources. The weakness is a classic input validation flaw (CWE‑20). This can lead to unauthorized data modification or exposure, compromising confidentiality and integrity of the local machine.

Affected vendors include Google, with the Chrome browser product on Windows. Any installation of Chrome on Windows that has a version earlier than 149.0.7827.53 is susceptible to the privilege‑escalation flaw.

The CVE is scored at 7.8, indicating a high risk when the flaw is exploitable. EPSS is not available, indicating no publicly known exploitation probability at this time, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local; an adversary who can drop a crafted file on the victim’s machine and trigger it via the UI can elevate privileges. Because the flaw requires local access, the attack surface is limited, but the high severity and permission escalation warrant prompt mitigation.