Insufficient policy enforcement in the Actor component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to bypass navigation restrictions by delivering a crafted HTML page. This flaw permits a protected page to navigate to an arbitrary URL without user consent, enabling the browser to access resources that were intended to be blocked by policy. The impact is unauthorized navigation, not direct code execution.

Google Chrome browsers below version 149.0.7827.53 are affected. Users running older legacy releases that have not yet been patched are at risk.

The CVSS score is 6.3 and EPSS is less than 1%, indicating a moderate severity but a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Based on the description, the attacker must provide a crafted HTML page that the victim’s browser will load; it is inferred that this could be delivered via a malicious website or compromised content. Once the page is rendered, the policy bypass allows navigation to disallowed URLs without user interaction, posing a moderate risk of malicious content delivery through redirected navigation.