A missing authorization check in the NFC subsystem of Google Chrome enables a remote attacker who has already compromised the renderer process to elevate privileges. By crafting a malicious HTML page, the attacker can bypass the operating system's access restrictions and perform actions that normally require higher privileges, potentially leading to data exposure or tampering.

The vulnerability affects Google Chrome versions earlier than 154.0.8037.57 on all platforms that support the NFC feature. Users on any desktop system running Chrome with a compromised renderer process are at risk.

The CVE does not have a publicly available EPSS score and is not listed in CISA's KEV catalog, suggesting limited exploitation in the wild at this time. Nevertheless, the exploit requires the attacker to have already compromised the renderer process, a scenario that is still plausible given historical browser exploits. With a CVSS score of 5.4 indicating medium severity, the risk remains significant for users who run unpatched Chrome versions.