The vulnerability resides in the lack of authorization checks within Google Chrome's FileSystem API. An attacker who has already obtained code execution in the renderer process can serve a crafted HTML page that bypasses the browser's same‑origin policy, allowing the attacker to read, write, or delete arbitrary files on the victim’s system. This breach can lead to data theft, tampering, or the delivery of malicious content, thereby impacting confidentiality, integrity, and availability.

The impacted vendor is Google, specifically the Chrome browser. All releases prior to version 152.0.7977.75 are affected, including any derivative Chromium‑based browsers that have not installed the specified update.

Chromium assigns a medium severity to this issue. No EPSS score is provided and the vulnerability is not listed in CISA KEV, suggesting a moderate probability of exploitation. However, the flaw requires that an attacker already obtain code execution within the renderer process – a prerequisite that may reduce the overall risk. Nonetheless, this condition still means that organizations using vulnerable Chrome versions should treat the issue with urgency and remediate promptly.