Google Chrome versions before 154.0.8037.57 contain an improper state validation flaw in the Downloads module that allows a remote attacker to craft an HTML page, causing the browser to bypass system access restrictions when a download is initiated. The weakness is classified as CWE-754, indicating a failure to enforce proper state checks during processing. A successful exploitation could grant an attacker unauthorized access to resources that Chrome is authorized to use, effectively elevating privileges within the user session.

Google Chrome installations older than 154.0.8037.57, regardless of operating system or platform. The issue is confined to the Chrome product and does not affect other components.

The vulnerability can be triggered remotely when a user opens or interacts with a malicious HTML page that initiates a download. Chromium identifies the issue as Medium severity; the CVSS score is 6.5, and the EPSS score is <1%. The vulnerability is not listed in CISA KEV. Based on the description, the attack vector is likely a malicious HTML page served over the web that a user visits, often through phishing or social engineering. Although the exact likelihood of exploitation cannot be quantified without EPSS data, the medium rating indicates a moderate threat level for users running affected versions.