The vulnerability is a policy bypass in the IFrameSandbox component of Google Chrome prior to version 147.0.7727.55. An attacker can craft a specialized HTML page and persuade a user to perform specific user interface gestures, such as clicking or dragging. When these gestures are executed, the browser incorrectly applies the sandbox policy, allowing navigation to arbitrary URLs that would normally be disallowed. This bypass does not grant direct code execution but eliminates the browser’s navigation restrictions, which can facilitate phishing, drive‑by downloads, or other content that relies on URL navigation.

Affected product is Google Chrome. Versions before 147.0.7727.55 are vulnerable, including all prior releases of the stable channel.

Chromium's security severity for this issue was low. The attacker must convince a user to interact with the malicious page, making it a user-dependent threat. No exploit probability data is available, and the vulnerability is not listed in the CISA KEV catalog. The risk is moderate because the bypass could lead to indirect attacks but it does not expose the system to direct remote code execution.