An inappropriate implementation in the PlatformIntegration component of Google Chrome on Windows platforms allowed a remote attacker to use social engineering techniques to bypass system access restrictions by delivering a crafted HTML page. The flaw permits the attacker to attain elevated privileges on the victim's machine, potentially enabling them to perform actions otherwise prohibited by Windows security controls. The vulnerability is classified as Low severity by Chromium security, indicating that while it can be exploited remotely, it is not considered highly dangerous in the absence of social engineering or other user interaction.

Google Chrome versions earlier than 154.0.8037.57 running on Windows operating systems are affected. The issue resides in the PlatformIntegration subsystem, which was present in all stable channel builds up to and including the 154.0.8037.56 release. Users who have not upgraded Chrome to 154.0.8037.57 or later are at risk.

The vulnerability requires a crafted HTML page and relies on user interaction or social engineering to be delivered. The EPSS score is below 1%, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Chromium labels the vulnerability as Low, but the CVSS score of 6.5 indicates a medium severity, suggesting a modest risk level. However, because the attack can be executed remotely through a web page, the potential for exploitation in phishing campaigns exists, and the attack vector is inferred to be through a malicious website or email attachment that displays the crafted page.