Google Chrome versions prior to 157.0.8103.38 contain an incorrect authorization check in the FileSystem API that allows a malicious website to access system files or execute code outside of the sandbox if a user engages with a crafted HTML page. The weakness is classified as Improper Authorization (CWE-863) and can be exploited by a remote attacker using social engineering techniques. Successful exploitation would grant the attacker the ability to run arbitrary code on the user's machine without sandbox restrictions, compromising confidentiality, integrity, and availability.

The vulnerability applies to Google Chrome browsers before version 157.0.8103.38. The affected builds are those distributed through the stable channel as referenced in the official release notes.

The vulnerability is marked high severity by Chromium’s internal scoring; however, an EPSS score is not available, indicating that the current data does not quantify exploitation likelihood. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to host a malicious HTML page that a user visits and interacts with via social engineering. Because the FileSystem API can execute code outside the sandbox, the impact is remote code execution, and the attack vector is most likely a remote, web‑based payload delivered through a crafted webpage.