An incorrect authorization check in Google Chrome’s WebUI allows a remote attacker to bypass system access restrictions and reach a privileged page through a crafted HTML page. The flaw can be exploited by serving a specially designed page that locally loads a restricted UI component, giving the attacker elevated access to browser settings or internal APIs. The weakness is documented as a missing permission check (CWE-863).

Version of Google Chrome prior to 157.0.8103.38 are affected. The issue occurs on all platforms where Chrome exposes the WebUI feature (desktop, Windows, macOS, Linux).

The vulnerability has a low Chromium security severity and no EPSS score is available, suggesting a modest exploitation likelihood. It is not listed in CISA’s KEV catalogue, indicating no publicly known active exploits. The likely attack vector involves tricking a user into visiting a malicious HTML page that targets Chrome’s WebUI; once the page is loaded, the attacker can access higher‑privilege browser interfaces.