The vulnerability is an insufficient enforcement of navigation policy in Chrome’s PDF viewer. A malicious PDF can be crafted so that when a user opens it, the browser navigates to an arbitrary URL, bypassing the usual restrictions that prevent navigation to potentially unsafe destinations. This bypass could allow a remote attacker to direct a user’s browser to malicious sites, phishing pages, or other content that could ultimately lead to further compromise.

Affected systems include all operating systems that run the affected Chrome version 146.0.7680.71 or earlier. This includes Chrome on Windows, macOS, and Linux desktops. The flaw exists only in the client‑side PDF rendering code bundled with the desktop browser and is not a server‑side issue.

The CVSS base score is 6.5, indicating a moderate risk. The EPSS score is below 1%, which signifies a low measured exploit probability. It is not listed in the CISA KEV catalog. The flaw can be exploited by a remote attacker who sends a malicious PDF to a target user, who must then open it. The most likely attack vector involves social engineering or attachment delivery, with no need for the attacker to compromise the network or the browser remotely.