Chrome’s FileSystem implementation validates untrusted input insufficiently, allowing a crafted HTML page to exploit a renderer process that the attacker has already compromised. The flaw enables the attacker to read or write arbitrary files on the user’s system, potentially leading to data theft, tampering, or privilege escalation. This represents a significant breach of local data confidentiality and integrity for affected installations.

Google Chrome versions prior to 148.0.7778.96 are affected. Users running these releases on any platform are at risk until the vulnerability is remediated.

The vulnerability is marked as Medium severity by Chromium’s own assessment. The CVSS score is 4.2, and exact EPSS data is not available, suggesting no evidence of widespread exploitation yet, and the feature is not listed in the CISA KEV catalog. Nonetheless, because the flaw permits arbitrary file read/write once the renderer is compromised, it remains a critical risk for environments where malware could gain renderer access or where malicious extensions could leverage the vulnerability.