An inappropriate implementation in the Link Preview feature of Google Chrome before version 149.0.7827.53 allowed a remote attacker, having already compromised a renderer process, to bypass navigation restrictions by serving a malicious HTML page. The attacker can force the renderer to navigate to URLs that are normally blocked, potentially exposing the user to malicious content or enabling further exploitation. The weakness is an improper validation of navigation requests made by the link preview logic, which can be classified under improper access control.

All users of Google Chrome who have not updated beyond the 149.0.7827.53 release are affected. Only the Chrome browser is impacted; no other Google products or third‑party applications are listed.

Chromium rates this vulnerability as medium severity. The EPSS score is unavailable and it is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Exploitation requires the attacker to first compromise the renderer process, after which the crafted HTML can be delivered via any website the user visits. While the remaining barrier of renderer compromise lowers the probability of opportunistic attacks, targeted campaigns could leverage this weakness to bypass security controls.