Google Chrome’s Bisection component suffered from improper handling of user supplied input, giving rise to a code injection vulnerability that is triggered by a specially crafted file. When a user opens such a file, the injected code can execute within the browser process and read data that the browser processes, such as credentials or other sensitive information. The flaw is classified as a medium severity weakness and is identified in the CWE-94 category of code injection.

This issue affects all desktop versions of Google Chrome prior to 152.0.7977.65. The vulnerability is present on every operating system that hosts the Chrome browser as of the stated version cutoff.

The CVSS score is 6.5, and the EPSS probability is <1%; the vulnerability is not listed in the CISA KEV catalogue. Externally, an attacker must craft a malicious file and convince a user to open it, implying that while the attack vector is remote externally, it requires a user action. Once the file is opened, the attacker can read sensitive information. Given the medium severity rating and the need for user interaction, the overall risk is moderate, but the potential impact on confidentiality for affected users is significant.