A flaw in Google Chrome’s navigation system allows a remote attacker to create a crafted HTML page that bypasses client‑side navigation restrictions. When a user loads the page, the browser is misled into navigating to URLs or resources that should be blocked, exposing the user to phishing, drive‑by downloads, or other web‑based threats. Chromium rates the vulnerability as low severity; it does not enable remote code execution, credential theft, or other direct system compromise.

Google Chrome installations running any version earlier than 149.0.7827.53, across all supported operating systems. The flaw resides in the Navigation component of Chrome and is present in any build that predates the 149.0.7827.53 release. Users who have not applied the latest patch remain vulnerable.

The CVSS score of 4.3 indicates low severity. The EPSS score is <1%, implying a very low exploitation probability. The vulnerability is not present in CISA’s KEV catalog. Attackers would need to entice a user to visit a maliciously crafted page, either locally or from a remote host. Practical exposure is therefore limited to users who open such a page, and the security boundary breach does not lead to remote code execution or system compromise on its own.