This vulnerability arises from insufficient validation of untrusted input within Chrome’s Popup Blocker. A remote attacker who has already compromised the renderer process can craft an HTML page that bypasses navigation restrictions, effectively allowing the attacker to redirect the user or trigger unintended navigation. The weakness is a classic input validation flaw (CWE‑20). The impact is that an attacker can alter the navigation flow with potentially malicious content, compromising user experience and potentially facilitating further attacks in a compromised renderer context.

Google Chrome versions before 148.0.7778.96 are affected. The issue is specific to the desktop Chrome stable channel and applies to all platforms running the affected builds.

The CVSS score is 4.2, indicating a Medium severity rating. The EPSS score is not available, so the precise exploitation probability cannot be quantified. It is not listed in the CISA KEV catalog, suggesting no widespread, confirmed exploits are publicly known. The likely attack vector requires an attacker to already compromise the renderer process, which typically requires an additional vulnerability or social engineering. This limitation reduces the immediacy of risk but still warrants prompt remediation.