The CVE describes that in Chrome versions before 147.0.7727.55 an improper implementation in the PDF handling code allows a remote attacker to bypass the browser’s navigation restrictions by serving a specially crafted HTML page. This bypass enables the browser to navigate to a target location without the user’s consent, effectively breaking the intended security barrier. The weakness is captured by CWE‑346 and CWE‑358.

All desktop installations of Chrome on Windows, macOS and Linux running a version earlier than 147.0.7727.55 are affected. The flaw is located in the core PDF renderer bundled with the browser, so the impact does not depend on the operating system or specific extensions.

The CVSS base score of 4.3 marks the vulnerability as low severity. The EPSS score is below 1 %, indicating a very low likelihood of exploitation, and the issue is not currently listed in CISA’s KEV catalog. The likely attack vector is a remote attacker delivering a malicious HTML page that contains the vulnerable PDF, requiring the user to open the page or interact with it. While exploitation is straightforward for those with the requisite content, real-world abuse is expected to be limited.