An inappropriate implementation within the Companion component of Google Chrome on macOS, when a version earlier than 148.0.7778.96 is used, can allow a remote attacker to perform privileged system‑level actions. Malicious traffic can trigger the flaw to elevate the attacker’s permissions to those of the operating system. This leads to potential full compromise of the affected machine, exposing all files and services to the attacker.

Google Chrome for macOS. Versions prior to 148.0.7778.96 are affected. All installations that run a vulnerable Chrome build on macOS are at risk until updated to the patched version.

The vulnerability is remotely exploitable via network traffic targeting the Chrome Companion interface. Attackers would need to reach the victim’s machine via a network channel that the compromised browser accepts, after which they can trigger the flaw to gain operating‑system privileges. This can lead to full compromise of the affected machine, exposing all files and services to the attacker. The lack of an assigned EPSS score remains unknown, and the vulnerability is not listed in the CISA KEV catalog.