Insufficient validation of untrusted input within Chrome’s Downloads component on Windows allows a remote attacker to bypass download restrictions by serving a crafted HTML page. The flaw, identified as CWE‑20, can deliver files to a user without triggering the browser’s usual download warnings, potentially facilitating malware delivery or data exfiltration. The vulnerability does not enable arbitrary code execution but undermines user protection by allowing silent or privileged downloads.

Google Chrome for Windows versions earlier than 147.0.7727.55 are affected.

No CVSS score is provided, but Chromium notes the issue as a medium‑severity problem. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to visit a malicious or compromised web page that serves the crafted HTML; once the user loads the page, the attacker can trigger downloads that bypass normal user confirmation. The risk remains until the update is applied.