A fault in the browser’s implementation allows a local attacker to gain elevated privileges by executing a crafted malicious file. The flaw involves improper privilege management, categorized as CWE-269. An attacker who can place a malicious file on the user’s system can trigger the bug and obtain higher privileges, potentially compromising the entire system, installation, or data.

The vulnerability affects Google Chrome for Windows versions earlier than 151.0.7922.72. Any user running these releases is susceptible until the vendor releases an update.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack requires local access and the presence of a malicious file, so it is feasible for an attacker who has compromised a machine or gained physical access.