The vulnerability arises from improper state validation within Chrome's FileSystem handling code before version 157.0.8103.38. A maliciously crafted HTML page can be used to trick a user into opening, allowing the attacker to bypass operating‑system access restrictions and execute privileged operations, thereby compromising confidentiality, integrity, and availability of the user’s environment.

Any installation of Google Chrome older than version 157.0.8103.38 is vulnerable. The problem exists in the stable channel of Chrome and is fixed in the subsequent release, 157.0.8103.38 and later.

EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. Chromium rates the issue as Medium severity; however, because the flaw can be triggered remotely via social engineering and permits privilege escalation or code execution, the practical risk can be significant for users who interact with untrusted web content. The primary attack vector is a website delivering a crafted HTML payload that, when visited or opened, will exploit the state‑validation bug to increase the attacker’s privileges through the victim’s browser session.