An improper access control implementation in Chrome for Mac allows a local user to load a malicious file that is then able to bypass navigation restrictions. Without this flaw the file would not be able to interfere with secured navigation flows. The weakness is classified as CWE‑284. As a result a local attacker can cause Chrome to navigate to URLs that should be blocked, potentially exposing sensitive data or enabling further compromise within the browser context.

Google Chrome for Mac versions earlier than 151.0.7922.72 are affected. This includes all pre‑151 stable channel releases on macOS that have not yet received the July 2026 security update.

The flaw carries a CVSS score of 6.2, indicating a moderate severity. The EPSS score is less than 1 %, suggesting that exploitation is rare. It is not listed in the CISA KEV catalog. Because the vector is local, a user must already have access to their account or a local file to take advantage of the vulnerability. No public exploit is known.