The vulnerability originates from an incorrect authorization check in the Views component of Google Chrome for macOS. The flaw, an instance of missing privilege validation (CWE-863), enables a crafted HTML page to bypass standard operating‑system access controls when a user is tricked into opening it. An attacker who succeeds in convincing a victim to view the malicious page can then execute commands with elevated privileges on the local machine.

macOS installations of Google Chrome running versions prior to 157.0.8103.38 are affected. The fix is included in the stable channel release of 157.0.8103.38 and later builds.

Chromium rates the severity of this flaw as Medium, and the EPSS score is unavailable. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires social engineering: the attacker must get a user to open a malicious HTML file or visit a spoofed web page. While the attack surface is limited to users who comply with the social‑engineering prompt, achieving privilege escalation on those machines allows arbitrary code execution and full system-level control.