In Google Chrome versions before 149.0.7827.53 an inadvertent File System Access handling flaw allows a remote attacker who lures a user into performing specific UI gestures on a crafted web page to circumvent discretionary access controls. The weakness effectively lets the attacker gain elevated file system permissions that the user would not normally have. This flaw is identified as a low severity issue but can be used to elevate privileges on the victim machine.

The vulnerability impacts Google Chrome running on any platform where the affected version is installed. Users of Chrome prior to update 149.0.7827.53 are at risk. No other vendors or product lines are directly listed.

Because the attacker must first persuade the user to interact with the malicious page, the attack vector requires user cooperation, which limits its scale. The EPSS score is not available, suggesting a low likely exploitation probability, and the flaw is not currently listed in CISA’s KEV catalog. Nonetheless, the potential for privilege escalation warrants precautionary action and patching by all users of the affected Chrome builds.