A security flaw in Google Chrome up to version 151.0.7922.72 allows a remote attacker to craft a domain name that bypasses the browser's enterprise navigation restrictions. The defect prevents proper enforcement of policy controls, enabling an attacker to silently redirect the browser to sites that the organization intends to block. This weakness is an improper authorization check and a lack of security process controls.

Any installation of Google Chrome on desktop operating systems running a version older than 151.0.7922.72 is affected, as the flaw resides in the Chromium browser component used by Chrome.

The CVSS score of 6.5 indicates a moderate to high severity impact. The EPSS score of less than 1% suggests that the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a crafted domain name, which a remote attacker could use to circumvent enterprise navigation policies. The risk is that users may be exposed to malicious sites that the organization intends to block.