An incorrect authorization check in Chrome’s Human Interface Device (HID) handling let a maliciously crafted HTML page cause the browser to treat it as an authorized request, enabling a remote attacker to circumvent system access restrictions. This weakness, classified as CWE-863, allows the attacker to act with higher privileges than normally permitted by the operating system's security model.

The flaw affects Google Chrome versions older than 157.0.8103.38. Users running any Chrome release prior to that build are vulnerable.

The issue is flagged as low severity by Chromium, and EPSS information is unavailable, indicating no current evidence of widespread exploitation. Because the vulnerability is triggered by a crafted HTML page that a user must open, it likely requires social engineering or insider delivery. The lack of a KEV listing and low reported severity suggest the risk is limited, yet a remote attacker who succeeds could bypass local security boundaries.