Improper input validation in the Shopping component of Google Chrome before version 157.0.8103.38 allowed a remote attacker to send crafted network traffic that bypassed system access restrictions and accessed privileged pages. The vulnerability enables an attacker to gain unauthorized access to pages normally protected by Chrome's security model, potentially exposing sensitive data or allowing further exploitation. The weakness is a classic input validation flaw.

Google Chrome browsers running any version earlier than 157.0.8103.38 are vulnerable. This includes all desktop Chrome installations where the Shopping feature is enabled, regardless of the operating system. The issue affects the desktop Chrome stable channel and any derivative distributions that use the same component stack.

The vulnerability has a Medium severity rating according to Chromium's scoring. No EPSS score is available and it is not listed in the CISA KEV catalog. The exploitation requires a remote attacker to send specifically crafted network traffic to the vulnerable Chrome instance, typically from a malicious website or server that can reach the target. While the attack surface is remote, the lack of a publicly known exploit coupled with the moderate severity means that the risk should be assessed by security teams but is not expected to be widely leveraged yet. Defensive measures focused on disabling the Shopping feature or applying the security update will mitigate the threat.