The vulnerability is an inappropriate implementation in Chrome’s Safe Browsing component that allows a remote attacker to bypass discretionary access control when a specially crafted RAR archive is processed. This flaw represents an improper access control (CWE-284) and improper authorization (CWE-551) vulnerability. The CVE description does not explicitly state an attack vector; the likely attack vector is the delivery of a malicious RAR file to Chrome, which is then processed by the browser. This flaw provides a means to circumvent the normal access controls set on RAR files, potentially exposing protected resources within the browser, and is rated as medium severity by Chromium.

The flaw affects Google Chrome versions prior to 149.0.7827.53. Users running any unstable channel or earlier stable releases are potentially exposed until a patch is applied.

The EPSS score is < 1% and the issue is not listed in CISA’s KEV catalog. The CVSS score of 6.5 indicates a medium severity vulnerability. The CVE description does not directly mention an attack vector; we infer that a malicious crafted RAR file can be delivered to Chrome, for example via a phishing site or a compromised download. The attacker would exploit the flaw when Chrome processes the archive, enabling the attacker to bypass the intended access restrictions on that file.