Chromium's updater component performed insufficient validation of untrusted input, allowing a local attacker who can place a malicious file for the updater to be processed to gain OS‑level privileges. The flaw enables privilege escalation on the affected system, potentially providing full control over the operating system. The weakness is a classic input validation and untrusted file handling problem (CWE‑20 and CWE‑434).

Google Chrome browsers running versions earlier than 151.0.7922.72 are impacted. The issue resides in the updater module bundled with the desktop Chrome client, and is limited to user installations of Chrome; server‑side deployments are not mentioned as affected.

The CVSS score of 7.8 indicates a moderate to high severity threat, while the EPSS score of less than 1% suggests a very low likelihood of exploitation under normal circumstances. The flaw requires local access, so an attacker must already have some presence on the machine; once achieved, escalation to root or system level is possible. The vulnerability is not listed in the CISA KEV catalog, and no official workaround exists; therefore applying the vendor patch is the only recommended course of action.