An inappropriate implementation in the Serial API of Google Chrome enables a remote attacker to inject arbitrary scripts or HTML into a page when a user visits a specially crafted HTML file. The vulnerability is classified as a user-experience cross-site scripting (UXSS) flaw and is identified with CWE‑79. If exploited, the attacker can execute arbitrary JavaScript in the context of the browsing session, potentially compromising user data or performing malicious actions under the user's authority. The affected code path requires the victim to load a malicious HTML page that triggers the flaw. The severity rating is CVSS 6.1, indicating a moderate risk to confidentiality, integrity, and availability of the affected user’s system.

Google Chrome is the only vendor/product mentioned. The vulnerability exists in all versions prior to 149.0.7827.155; no specific version list is supplied, so the recommendation is to treat all earlier releases as affected. No work‑arounds or patch details are published by the vendor in the provided data.

The flaw has a low EPSS score (<1%), suggesting current exploitation likelihood is very limited. It is not listed in the CISA KEV catalog, which further reduces immediate threat perception. However, because the attack vector involves a crafted HTML page, anyone who can persuade a user to load that page can trigger the vulnerability. The CVSS score highlights that the flaw can potentially lead to user session compromise but does not allow remote code execution beyond the browser context.