Google Chrome versions prior to 148.0.7778.96 have insufficient policy enforcement in the Downloads component, allowing a local attacker to craft an HTML page that forces the browser to navigate to URLs that would normally be blocked by navigation restrictions. This access‑control flaw lets a malicious local user redirect Chrome to arbitrary destinations or initiate downloads that are otherwise disallowed, potentially facilitating delivery of malicious code or exfiltration of data.

The vulnerability impacts any installation of Google Chrome running a version earlier than 148.0.7778.96. All operating systems that receive the Chrome stable channel are affected until the fix is applied.

The CVSS score of 4.4 reflects a medium severity, the EPSS value is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires local user privileges and a crafted HTML file, making the vector local rather than remote. Because the exploitation data is limited, real‑world risk is uncertain, but the possibility of bypassing navigation controls poses a significant threat to local users with privileged access.