The vulnerability is an insufficiency in Chrome’s Actor policy enforcement that lets a remote attacker load a crafted HTML page to bypass navigation restrictions. This flaw enables an attacker to direct a user to URLs that should be blocked, potentially facilitating phishing or delivery of malicious content. The weakness represents a Medium severity issue from Chromium’s own assessment, indicating a non‑fatal but significant impact on user protection.

Google Chrome versions prior to 149.0.7827.53 are affected. A single update to that version or later resolves the problem. The flaw is limited to browsers using the Actor component, and does not impact the underlying operating system or other software.

The vulnerability is exploitable over the network by serving a specially crafted web page. Attackers would need to deliver the page to a user using a vulnerable Chrome build. Because no EPSS data is present and the flaw is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is currently unclear, but the medium severity rating suggests moderate assessment importance. Upgrading to the patched release should eliminate the risk.