Insufficient enforcement of enterprise policies in Google Chrome for macOS, before version 151.0.7922.72, enabled a local attacker with physical access to the device to elevate privileges and gain higher system access. The flaw leverages missing checks for policy enforcement, allowing an attacker to bypass restrictions that should be applied to prevent unrestricted local changes.

Google Chrome on macOS installations running any version earlier than 151.0.7922.72 are affected. This includes all users of the Chrome browser who have not applied the latest patch on their macOS devices.

The vulnerability carries a CVSS score of 6.8, indicating moderate severity, and an EPSS score of less than 1%, suggesting a very low probability of exploitation in the wild. It is not listed in CISA’s KEV catalog. Exploitation requires local, physical access to the device, making it primarily relevant to scenarios where an adversary can physically interact with the target machine. The lack of enforceable enterprise policy enforcement creates a privilege escalation path that could compromise system integrity and confidentiality if an attacker gains elevated local rights.