The flaw in Chrome’s enforcement of Content Security Policy allows a remote attacker to bypass security restrictions by loading a specially constructed HTML page. This bypass lets the attacker serve content that would normally be blocked. The weakness is rooted in improper policy validation (CWE-693) and input validation (CWE-79) oversight.

Google Chrome versions prior to 149.0.7827.53 are affected. The issue was identified as a policy bypass that only impacts browsers running those builds.

Chromium’s internal assessment rates the vulnerability as low severity (CVSS 4.3), and the EPSS score is <1%. The flaw is not currently listed in the CISA KEV catalog. An attacker can exploit the weakness remotely by serving the crafted HTML page to a user’s browser, enabling the bypass without additional foothold. Because of the low severity rating and lack of an enterprise focus, the likelihood of large‑scale exploitation is considered modest, though the attack vector remains fully remote.