Google Chrome prior to version 149.0.7827.53 did not correctly enforce policy rules for Content Settings, allowing a remote attacker to craft a malicious HTML page that could bypass normal discretionary access controls. The flaw is an Improper Authorization (CWE-284) and a lack of proper permissions enforcement (CWE-280). The consequence is that a user visiting the malicious page could alter Chrome’s content settings, potentially enabling further malicious actions such as tracking, cookie injection, or HTTPS overrides. The attacker thereby gains unauthorized configuration privileges that could facilitate subsequent attacks.

Google Chrome browsers running any platform version earlier than 149.0.7827.53 are affected. The issue arises from shared policy enforcement code and impacts all operating systems supported by Chrome.

The EPSS score of 0.0002 (< 1%) and the fact that it is not listed in the CISA KEV catalog suggest no known widespread exploitation. The CVSS score of 4.3 indicates a low severity rating. The vulnerability is exploitable through a remote attack vector: a victim must open a crafted web page in Chrome. No privileged escalation is required; any user who loads the page can trigger the bypass. While the impact is limited to policy configuration, an adversary could chain this to more damaging actions, so the risk is moderate in environments where sensitive content settings are critical.