A flaw in Google Chrome’s enforcement of Content Security Policy permits an attacker to bypass the policy by loading a specially constructed HTML page. The vulnerability enables the attacker to inject or execute arbitrary content that would normally be blocked by the policy, potentially leading to cross‑site scripting or other unauthorized code execution within the browser. The weakness stems from an oversight in policy validation and enforcement.

Google Chrome versions prior to 149.0.7827.53 are affected. The issue was identified as a policy bypass that only impacts browsers running those builds.

Chromium’s internal assessment rates the vulnerability as low severity, and the EPSS score is not available. The flaw is not currently listed in the CISA KEV catalog. An attacker can exploit the weakness remotely by serving the crafted HTML page to a user’s browser, enabling the bypass without additional foothold. Because of the low severity rating and lack of an enterprise focus, the likelihood of large‑scale exploitation is considered modest, though the attack vector remains fully remote.