Technical impact
Insufficient policy enforcement in Chrome's Presentation API allows a remote attacker to bypass navigation restrictions using a crafted HTML page. This flaw, identified as CWE‑1021 and CWE‑602, lets the attacker direct a user’s browser to an arbitrary URL without going through the normal security checks. The result can be a redirection to malicious sites, phishing attacks, or other unwanted content, compromising user trust and potentially exposing sensitive information.
Affected Systems
The issue affects Google Chrome browser versions prior to 151.0.7922.72. Users running those releases are vulnerable to exploitation if they visit a maliciously crafted page. No exact sub‑version list is provided beyond the stated cutoff, so all older revisions are considered at risk.
Risk and Exploitability
The CVSS score of 6.5 rates this problem as high severity, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation. The flaw does not appear in the CISA KEV catalog, suggesting it has not been widely exploited or that it is an early‑stage vulnerability. An attacker would need to host a crafted HTML page and convince a user to load it; no privileged access or additional credentials are required.
Debian DLA
Debian DSA