This vulnerability arises from an improper implementation in the Mojo IPC system within Google Chrome for Windows. A malicious local file can trigger the flaw, giving the attacker the ability to elevate privileges at the operating‑system level. The weakness is a type of privilege‑escalation flaw that undermines user isolation and could allow local code to run with administrative rights if the attacker can get the file processed by Chrome.

Google Chrome installed on Windows operating systems, versions prior to 149.0.7827.115, are affected. Users of older Chrome builds that have not updated to the 149.0.7827.115 release are at risk.

Security severity is classified as High by Chromium. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker must be able to place or create a malicious file on the system for the exploitation path to succeed. Once the file is processed by Chrome, the flaw can be leveraged to gain OS‑level privileges, making the risk significant for any user with local access. The lack of exploitation metrics suggests the risk is driven by the high severity of the flaw rather than by widespread exploitation activity.