Google Chrome versions prior to 154.0.8037.57 contain a missing authorization check in the WakeLock API. If a remote attacker can compromise the renderer process, they can serve a specially crafted HTML page that exploits this flaw to bypass system access restrictions. The vulnerability allows the attacker to elevate privileges within the local process context and access resources that should be protected by the operating system. This limitation is categorized as a low‑severity issue by Chromium but still permits unauthorized changes to system resources.

Google Chrome for desktop, versions before 154.0.8037.57 are affected. The vulnerability does not exist in later releases of Chrome.

The issue is only exploitable when the attacker already has control over the renderer process or can influence its execution path, making the likelihood of exploitation relatively low. The EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.4 indicates high severity, even though the Chromium severity is low. The attack vector is local to the compromised renderer and requires a maliciously crafted HTML page to trigger the bypass. While the risk is modest, the potential impact of unauthorized system access warrants timely remediation.