A crafted HTML page can cause Google Chrome to ignore navigation restrictions that are normally enforced. The flaw is in the Glic implementation, representing an improper authorization weakness (CWE‑284) that allows a remote attacker to direct the browser to unintended locations. This does not lead to code execution or a denial‑of‑service, but it enables the attacker to move the user to arbitrary resources within the browser session, potentially exposing credentials or delivering malicious content.

Google Chrome desktop versions earlier than 149.0.7827.53 on any operating system that includes the Glic component – i.e., Windows, macOS, and Linux builds. Users running the affected builds and who have not applied the latest stable update are at risk.

The CVSS base score of 6.3 and an EPSS score of <1% indicate a moderate level of risk, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remotely hosted malicious web page; the analysis infers that an attacker could embed the crafted page in phishing campaigns or compromised sites, requiring the user to load it in Chrome. While no confirmed exploits exist, the flaw can be leveraged by any entity that can deliver HTML content to a Chrome user, so organizations should address it promptly.