This vulnerability arises from an inappropriate implementation in the Safe Browsing component of Google Chrome before version 149.0.7827.53. It enables a remote attacker to bypass discretionary access control mechanisms by delivering a specially crafted RAR archive. The issue is classified under CWE-284 (Improper Access Control). The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory linked does not explicitly state whether a fix is available or planned.

The vulnerability allows an attacker to bypass discretionary access control, potentially leading to unauthorized modification of data or system state (integrity impact). There is no impact on confidentiality or availability. The attack requires user interaction and can be executed remotely over the network. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when handling RAR files from untrusted sources and consider disabling or restricting Safe Browsing features if possible as a temporary mitigation.