Chrome's audio policy enforcement allows a crafted webpage to trick a user into performing a specific set of UI interactions. The page can then bypass sandbox download restrictions, enabling the user to download files that would otherwise be blocked. This change opens a path for a remote attacker to obtain local files or slide into the sandbox boundaries, compromising data confidentiality and potentially facilitating further malicious activities.

Google Chrome versions earlier than 147.0.7727.55 on the stable desktop channel are vulnerable. Only Chrome’s standard desktop build is affected; mobile or other platforms are not listed.

The vulnerability carries a low Chromium severity score and has no EPSS data or KEV listing, indicating a modest overall risk. Exploitation requires a remote attacker to persuade a user to browse a malicious HTML page and perform specific gestures. Because it relies on user interaction, the attack vector is “User Interaction” over “Remote Web.” Nevertheless, any compromised download could lead to sandbox escape or local file disclosure, so the potential impact is nontrivial if attackers succeed.