Improper input validation in the Variations component of Google Chrome enabled a remote attacker to bypass system access restrictions by sending crafted network traffic. The flaw allows malicious data to be interpreted without proper sanitization, causing the browser to treat the traffic as legitimate and consequently granting elevated privileges or unrestricted system access. The vulnerability is categorized as a low severity issue by Chromium per its internal scoring, but the potential to elevate local privileges from a remote source represents a serious security risk.

All desktop editions of Google Chrome running versions earlier than 157.0.8103.38 are vulnerable. This includes every Chrome release on which the Variations service is active. The flaw affects users on Windows, macOS, and Linux since it is not tied to a single OS. The specific affected versions are all those that precede the 157.0.8103.38 patch.

The vulnerability lacks an associated CVSS score, and no EPSS data is currently provided, so the measured exploitation likelihood is unknown. The core weakness is stated as CWE-20, which is improper input validation. Because the flaw can be triggered via network traffic, a remote attacker only needs to deliver specially crafted packets to the victim's machine. No special local access or privilege is required to exploit it. The risk is high for users who do not update Chrome promptly. The vulnerability is not listed in CISA's KEV catalog, indicating no publicly known exploits at the time of this analysis.