A flaw in Chrome’s SmartCard cleanup code allows a remote attacker to exploit a crafted HTML page. When a user loads the malicious page the cleanup failure can bypass system access restrictions, effectively granting the attacker elevated privileges. The weakness maps to CWE‑459 – an improper use of uninitialized or incomplete resources.

All installations of Google Chrome older than 154.0.8037.57 are affected. The vulnerability was identified in the Chrome browser version 154.0.8037.56 and earlier, regardless of operating system.

The CVSS score is 6.5, and the EPSS score is listed as < 1%. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been reported as actively exploited. Attackers would need to lure a user into opening a specially crafted HTML page, typically via phishing or social engineering. Once opened, the incomplete cleanup enables the attacker to circumvent system access controls and potentially take over the user’s session or other privileged resources.