Insufficient policy enforcement in Chrome’s Network component prior to version 150.0.7871.47 allows a remote attacker to craft an HTML page that forces the browser to navigate outside user‑defined navigation restrictions. This flaw is classified as CWE‑602 Network Access Control. The primary impact is that an attacker can redirect a user to arbitrary URLs, potentially facilitating phishing or delivery of malicious content without additional privileges.

All installations of Google Chrome with a version older than 150.0.7871.47 on supported operating systems are susceptible to this bypass.

The CVSS score of 4.3 indicates low overall severity, and the EPSS score of less than 1% suggests a modest likelihood of exploitation in the wild. A remote attacker can trigger the flaw by hosting a crafted page and does not require elevated privileges or local access. The vulnerability is not listed in CISA’s KEV catalog, meaning no confirmed widespread exploitation has been reported, yet the potential to mislead users remains.