The flaw is an incorrect authorization check in Chrome's DevTools. It permits an attacker who lures a user into opening a crafted HTML page to run arbitrary code outside the browser sandbox. This makes the vulnerability a classic silent remote code execution vector that can compromise the machine if the user is deceived into executing the malicious page.

All releases of Google Chrome before version 157.0.8103.38 are affected. The issue is flagged for the stable channel and applies to all operating systems where Chrome is installed.

The CVE has a medium severity rating according to Chromium. The exploit requires social engineering to convince the user to load the malicious page, but once accomplished the attacker can break out of the sandbox and execute code. EPSS data is not available and the issue is not listed in the CISA KEV catalog, so the likelihood of widespread automated exploitation is currently unclear. However, given the potential for arbitrary code execution, the risk to affected users is high.