An authorization flaw in Chrome’s core module lets a remote attacker with a compromised renderer process inject a crafted HTML page that bypasses system access controls. The flaw, identified as CWE‑863, permits the attacker to perform actions normally restricted to system processes. The vulnerability is rated medium severity by Chromium, indicating a meaningful increase in risk but not a full remote code execution.

All versions of Google Chrome before 157.0.8103.38 on any supported platform are affected. The issue is tied to the renderer process and the browser core, so any system using a vulnerable Chrome build is at risk.

The vulnerability is exploitable by an attacker who can supply malicious content that is processed by the renderer. Because the attacker must already compromise the renderer, the attack vector is remote but requires hosting or delivering a malicious page. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but the medium CVSS rating suggests a moderate likelihood of exploitation in targeted attacks. Users running outdated Chrome should treat this as a priority to mitigate privilege escalation potential.