This vulnerability arises from an improper implementation in the Enterprise edition of Google Chrome prior to 149.0.7827.53. It allows a local attacker who has physical access to the device to gain higher privileges than intended, potentially compromising the entire system. The weakness can lead to unauthorized system modifications, data exposure, or further attacks, though it is classified as low severity by Chromium.

Affected systems are Google Chrome Enterprise installations running any revision before 149.0.7827.53.

The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, reflecting its niche impact. The low attribution in Chromium’s security severity scale and the necessity of local physical access reduce the overall risk. However, if an attacker already has physical access to an Enterprise-managed device, they can abuse this flaw to elevate privileges. Exploitation requires no network connection or special software and can be performed without additional user interaction once the device is compromised physically.