Chrome provides SiteSettings to control permissions such as camera, microphone, and site access. An incorrect authorization check in the SiteSettings component allowed a remote attacker to create a crafted HTML page that could modify these settings, effectively bypassing system access restrictions. This flaw is a CWE‑863 authorization bypass that lets malicious content change security settings without user consent, potentially granting the attacker higher privileges or access to protected data.

All Chrome releases prior to version 152.0.7977.75 are impacted. Users who have not upgraded to this or later versions are at risk.

The CVSS score of 6.5 reflects a medium severity. The EPSS score is < 1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the issue requires delivery of a crafted HTML page, the likely attack vector is a remote or local web page that the user opens in Chrome. Attack conditions include the user enabling SiteSettings changes; once the malicious page is loaded, the attacker can alter or circumvent system access controls. Limited exploit data makes precise likelihood uncertain, but the medium severity indicates a non‑negligible risk.