This vulnerability stems from an inappropriate implementation in Google Chrome’s Isolated Web Apps, allowing a remote attacker to bypass navigation restrictions through a specially crafted HTML page. The issue provides a means for an attacker to force the browser to navigate to arbitrary destinations, potentially leading to phishing, credential theft, or access to internal content that would normally be protected by navigation controls. The weakness can be classified as an instance of improper access control.

All users of Google Chrome versions prior to 151.0.7922.72 are affected. The vulnerability is relevant to the stable channel of Chrome, impacting both desktop and potentially other platforms where the unsupported version is installed.

The CVSS severity is listed as Medium and the EPSS score is below 1%, indicating a low estimated probability of exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires a victim to load a crafted HTML page, after which the attacker can force navigation to arbitrary URLs. Because the attack vector involves directing the victim’s browser via a locally crafted page, it is most effective against users who open untrusted web content or click on malicious links.