Google Chrome’s DevTools implementation does not strictly enforce navigation policies, allowing a local attacker to craft an HTML page that bypasses the intended navigation restrictions. The vulnerability is a form of improper authorization (CWE‑602) and involves content manipulation (CWE‑807). Although it does not enable remote code execution, it can lead to unauthorized access to restricted URLs and potentially expose sensitive data or provide a foothold for further local exploitation.

All users of Google Chrome’s stable channel running any version prior to 151.0.7922.72 are affected. The security update is released as 151.0.7922.72 and newer versions contain the fix.

The CVSS score of 6.5 indicates a moderate impact, while the EPSS score of <1% reflects a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting it has not been widely observed. Exploitation requires local access to the user’s machine, the ability to open DevTools, and the delivery of a crafted page, so the primary attack vector is local. Overall risk remains moderate but warrants timely patching.