Google Chrome’s Safe Browsing component contains an information loss condition on macOS that allows a crafted HTML page to be served to the victim and cause the browser to skip normal system access checks. The flaw is a specific instance of sensitive data mismanagement, mapped to CWE‑221, and it could let a remote attacker hijack user workflows or elevate privileges on the target machine by bypassing protective checks in the browser’s sanitization logic.

The vulnerability appears in macOS‑based installations of Google Chrome running any build older than the stable release 153.0.8010.36. Users with these versions should evaluate whether they are still supported or exposed to web content from untrusted origins.

The reported CVSS score is 6.5, corresponding to medium severity according to Chromium’s internal scoring. The EPSS score is <1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to host or serve a malicious HTML page that a victim’s Chrome instance renders, which is a typical web‑based attack scenario. Although the exploit requires outward user interaction, the risk remains non‑negligible in environments where users routinely visit untrusted sites or use lower‑version browsers.