An inappropriate implementation of the Google Lens feature in Google Chrome allowed a remote attacker to bypass navigation restrictions by serving a specially crafted HTML page. The vulnerability enables a user to navigate to sites or content that would normally be blocked or restricted, potentially exposing them to malicious content or policy violations. The affected code was flagged with a low Chromium security severity, indicating that it is unlikely to lead to direct data compromise or system takeover on its own.

The flaw exists in Google Chrome on all platforms before version 149.0.7827.53. Any installation of the browser that has not yet been updated beyond this release is affected.

The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Because the issue is triggered by a crafted HTML page, an attacker can host or send such a page to a victim who is using an unpatched Chrome version, making the attack vector remote through normal web traffic. The CVSS rating is 8.8, indicating a high severity, so while exploitation is feasible, the likelihood of widespread impact is higher than previously assumed unless mitigated.