The vulnerability arises from missing authorization checks in Chrome's Views component, allowing a crafted HTML page to bypass normal system access restrictions. An attacker who successfully social engineers a user into opening such a page can gain unauthorized access to the browser’s local resources, effectively allowing privilege escalation or sensitive data exposure. This flaw falls under Missing Authorization (CWE‑862) and could grant an attacker elevated privileges within the context of the user’s session.

The flaw impacts Google Chrome versions prior to 153.0.8010.36 on all supported operating systems. Any user who has not upgraded from a stable channel build older than 153.0.8010.36 is vulnerable.

Chromium rates the defect with a CVSS score of 8.8, classifying it as high severity. Exploitation requires the victim to be tricked into viewing a malicious HTML page, a social‑engineering scenario that is feasible in many real‑world contexts. The EPSS score is <1%, and the issue is not listed in CISA's KEV catalog, but the high severity combined with a broad window of affected releases indicates a significant risk for users who rely on Chrome for everyday web browsing.