The vulnerability arises from an inappropriate implementation in the Chrome installer for Windows. A malicious file present during installation can be used by a local attacker to gain operating‑system level privileges, effectively compromising the host machine. This allows the attacker to execute arbitrary code with elevated rights.

The affected product is Google Chrome for Windows. Versions before 149.0.7827.53 are vulnerable. Users of any Windows workstation running these Chrome releases are at risk.

The vulnerability is rated high severity with a CVSS score of 7.8. The EPSS score is below 1%, indicating a very low probability of exploitation, and the issue is not listed in CISA's KEV catalog. Exploitation requires local access to an untrusted file during the Chrome installation process; it is not a remote attack. A local attacker can trigger the malicious installer to execute code with elevated privileges, giving them OS-level control. Because the attack surface is limited to environments where the installer can be modified, the window of exploitation is narrow.