The flaw resides in the Downloads component of Google Chrome and permits a remote attacker to craft an HTML page that bypasses Chrome’s navigation restrictions. By loading the page, a malicious user could potentially trigger download-related navigation actions that Chrome normally forbids, thereby enabling the attacker to influence or hijack browser navigation. The weakness is rooted in inappropriate handling of navigation constraints within the download flow.

The vulnerability affects Google Chrome. Specific version details are not listed in the public advisory; however, the issue impacts all Chrome installations that have not applied the security update 149.0.7827.53. No other vendors or products are indicated in the CNA’s notified scope.

Chromium classifies the severity of this issue as Low, and no EPSS score is presently available, so the likelihood of exploitation cannot be quantified. The problem has not been included in the CISA KEV catalog. Based on the description, the attack vector is remote and depends on a crafted HTML page that the user must open or navigate to, implying that social‑engineering or phishing could be used to entice victims. Given the lack of a high CVSS score and the absence of a known exploit, the risk remains modest but is not negligible in environments where browsers are configured to download without strict navigation checks.