Insufficient enforcement of the sandbox policy for iframes in Google Chrome on Windows before version 148.0.7778.168 allows a remote attacker to craft a HTML page that causes the browser to bypass navigation restrictions within a sandboxed context. The flaw does not grant code execution or full sandbox escape; it specifically enables an attacker to redirect or load disallowed URLs under the illusion of sandbox isolation.

Google Chrome running on Windows systems with versions older than 148.0.7778.168. Users of the stable channel using these older releases are vulnerable until an update is installed.

The EPSS score is 0.00016, indicating a very low exploitation probability, and the vulnerability is not listed in CISA KEV. A remote attacker can host a malicious HTML page and serve it to a victim, causing the victim’s browser to navigate to attacker‑controlled URLs from a sandboxed iframe. The attack does not require additional system privileges and relies on the browser’s mis‑enforced policy, and with a CVSS score of 4.3 it is classified as medium severity per Chromium’s classification.