Insufficient policy enforcement in Chrome’s History Navigation allows an attacker to inject arbitrary scripts or HTML through a crafted page when a user performs specific UI gestures. The flaw enables user‑interaction‑based cross‑site scripting (UXSS), which can execute malicious code in the context of the browser and lead to data theft or session hijacking. The vulnerability is linked to CWE‑346 (Broken Access Control) and CWE‑79 (Cross‑Site Scripting).

Google Chrome browsers running any version earlier than 147.0.7727.55 on Windows, macOS, and Linux are affected. The flaw does not depend on the operating system, but any Chrome installation in the specified version range is vulnerable.

The CVSS score is 6.1, indicating a medium‑severity vulnerability. The EPSS score is below 1%, showing a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to craft a malicious page and convince a user to interact with certain UI gestures; it is a user‑interaction‑dependent attack rather than a purely remote exploit. If successfully performed, it permits execution of arbitrary scripts in the user’s browser context, potentially leading to sensitive data exposure or unauthorized actions performed on behalf of the user.