The vulnerability is a policy bypass in the LocalNetworkAccess feature of Google Chrome, which can be triggered by a crafted HTML page. It allows a remote attacker to circumvent navigation restrictions and access local network resources that are normally blocked. This leads to potential confidentiality breaches and could also serve as a foothold for further compromise. The weakness is a form of improper access control (CWE‑284).

Affected systems are installations of Google Chrome running versions earlier than 147.0.7727.55. The current Chrome stable channel update, version 147.0.7727.55, includes the fix. Users on older releases or custom builds not yet updated are therefore susceptible.

The vulnerability has a Medium severity score. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. The exploitation pathway typically involves a malicious web page that a user visits, after which Chrome automatically attempts to access local network destinations that are normally restricted. Because the attack requires the user to open the crafted page, the risk depends on user behavior, but the potential impact of local network data exposure makes it a concern for environments with sensitive internal resources.