Incorrect authorization in a Google Chrome API allows a remote attacker who has already gained control of the renderer process to bypass system access restrictions by serving a specially crafted HTML page. The vulnerability is characterized by CWE‑863, which denotes that the software performs an action without validating that the caller has permission to do so, enabling an attacker to elevate privileges within the browser context.

Google Chrome versions prior to 157.0.8103.38 on desktop platforms are vulnerable; any installation of Chrome below this version may be impacted until the browser is updated.

The vulnerability carries a medium severity rating and requires the attacker to have compromised the renderer process, typically through malicious web content. Once the renderer is under attacker control, the attacker can invoke the unauthorized API to gain elevated system access, potentially leading to broader compromise of the host machine. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating that exploitation risk is moderate and likely constrained to environments where an attacker can subvert the renderer.