Insufficient enforcement of policy settings in Google Chrome prior to version 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to elevate privileges through a specially crafted HTML page. This flaw stems from inadequate privilege management (CWE‑266) and improper authentication of configuration changes (CWE‑346), enabling the attacker to gain higher access rights within the browser process.

Google Chrome users running the stable channel with a version older than 151.0.7922.72 are affected. All operating systems that run Chrome without automatic updates—Windows, macOS, Linux and Chrome OS—are at risk. The vulnerability does not affect other Chromium‑based browsers that implement policy enforcement correctly.

The CVSS score of 7.5 classifies this flaw as high severity, but the EPSS score of less than 1% indicates a low probability of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a remote attacker to already control the renderer process, typically through a social engineering attack or a cross‑site scripting payload, and then serve a malicious HTML page that triggers the privilege escalation.