This flaw occurs when the browser’s History interface fails to enforce proper authorization checks, allowing a crafted HTML page to request privileged actions normally denied to the user. By navigating to a malicious page, an attacker can exploit the browser to gain unauthorized control over the history feature. The injection relies on the browser’s built‑in History functionality rather than on traditional code‑execution paths.

Google Chrome versions earlier than 157.0.8103.38 are affected. Users of these releases must update to a patched build to eliminate the vulnerability.

The attack vector requires a user to click or otherwise interact with a crafted web page, making it a social‑engineering scenario. Chromium categorizes the issue as Low severity, and no CVSS or EPSS score is published. The flaw is not listed in the CISA KEV catalogue, suggesting a modest exploitation likelihood. Nevertheless, any machine running an unpatched browser remains exposed until the update is applied.