This vulnerability is a CWE-20 incorrect input validation flaw in Chrome’s Network component that enables a remote attacker, who has already compromised the renderer process, to serve a specially crafted HTML page and override the browser’s navigation restrictions. The attacker can redirect the user to unintended URLs or force the browser to load disallowed content. The description does not indicate direct code execution or operating‑system compromise, only navigation bypass.

Versions of Google Chrome earlier than 150.0.7871.47 on any platform that includes the affected Network component are vulnerable. It is inferred that all operating systems and architectures that ship the Network stack before this patch are affected, though the official data does not explicitly list each platform.

The issue has a CVSS score of 6.5, reflecting a medium severity. The EPSS score is < 1%, indicating a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Exploitation requires a prior compromise of the renderer process (e.g., a sandbox escape). If such a foothold is achieved, the attacker can redirect users to malicious sites or load unwanted content via the navigation bypass path. The overall risk is confined to scenarios where an initial renderer compromise already exists.