This vulnerability involves an incorrect authorization check in the Views components of Google Chrome on Windows. An attacker who first compromises the renderer process and then delivers a specially crafted HTML page can exploit the flaw to execute arbitrary code with privileges above the sandbox, elevating the level of compromise. The weakness is a missing authorization layer (CWE-863) and the severity has been rated Medium by Chromium.

The affected product is Google Chrome running on Windows. Versions earlier than 153.0.8010.36 are vulnerable. This includes the stable channel builds listed before the September 2026 update. No specific subversions are enumerated beyond the version cut‑off.

The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalogue. The CVSS score of 8.3 indicates a High severity. The attack requires the attacker to already gain control over the renderer process and use social engineering to serve a malicious HTML payload. While the exploit pathway is not trivial, the requirement for initial compromise and user interaction reduces the likelihood but does not eliminate the risk, especially for users who frequently interact with suspicious web content. The lack of an update mitigates the risk, but until patches are applied, the vulnerability remains exploitable.