The vulnerability arises from an inappropriate implementation in the Chrome installer for Windows. A malicious file present during installation can be used by a local attacker to gain operating‑system level privileges, effectively compromising the host machine. This allows the attacker to execute arbitrary code with elevated rights.

The affected product is Google Chrome for Windows. Versions before 149.0.7827.53 are vulnerable. Users of any Windows workstation running these Chrome releases are at risk.

The vulnerability is classified as medium severity. No EPSS score is currently available and the issue is not listed in the CISA KEV catalog. Exploitation requires local access to a private file and the installation of Chrome, meaning it is not remote. Local attackers can execute the malicious file during installation to elevate privileges. Given the local nature of the attack surface, the exploitation windows are limited to environments where untrusted files can be introduced during installation.