The flaw resides in Chrome’s Permissions module; prior to version 149.0.7827.53, it incorrectly enforces content security policy, allowing a crafted HTML page to bypass CSP constraints. Based on the description, it is inferred that this bypass could permit unintended script execution or data leakage, potentially compromising the integrity of the browser sandbox.

All stable channel desktop releases of Google Chrome older than 149.0.7827.53 are affected. The issue applies to every device that runs these browser versions regardless of operating system, because it is part of the Chromium rendering engine.

The CVSS score of 4.3 indicates low severity, and the EPSS score is <1%, signifying a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The CVE states a remote attacker can deliver a crafted HTML page, implying that social engineering or phishing may be used to trigger the exploit. No publicly disclosed exploit is known at this time.