Incorrect authorization in the FileSystem API of Google Chrome versions prior to 157.0.8103.38 could allow a remote attacker, given social engineering, to run arbitrary code outside the browser sandbox. This flaw is an authorization bypass that lets malicious content escape its confinement by misgranting file system access, leading to a complete loss of sandbox boundaries and exposing the host operating system and user data to compromise.

Google Chrome browsers with versions older than 157.0.8103.38

The CVE’s high Chromium security severity and lack of a reported KEV status indicate serious potential impact. No EPSS score is available, implying limited exploitation data. Vulnerability exploitation requires social engineering to deliver a crafted HTML page. If successful, the attacker will gain the ability to execute code outside the sandbox, potentially achieving full system compromise. Defenders should treat the risk as high pending further evidence.