The vulnerability is a missing authorization check in the DevTools component of Google Chrome versions prior to 157.0.8103.38. A remote attacker can craft an HTML page that, when opened by a user, uses DevTools APIs without the necessary authentication. The attacker can bypass system access restrictions, and the potential to execute arbitrary code is inferred from the described functionality but is not explicitly stated in the CVE data.

Google Chrome desktop users running any version earlier than 157.0.8103.38 are affected. The issue applies to the stable channel builds released before the update noted in the Chrome release blog.

Chromium rates the flaw as Medium severity and no EPSS score is available, so the exact exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to socially engineer a user into opening a malicious HTML page; the compromised DevTools session could provide privileged access to system resources, but it relies on user interaction or phishing.