This vulnerability arises from inappropriate implementation of policy enforcement in the Enterprise component of Google Chrome versions before 149.0.7827.53. It enables a local attacker who has physical access to the affected device to escalate their privileges. The CVSS vector indicates the attack requires physical access (AV:P), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality and integrity with high severity (C:H/I:H/A:N). No official fix or remediation level is stated in the provided data, and no exploits are known in the wild.

A local attacker with physical access to the device can escalate privileges due to insufficient policy enforcement in Chrome Enterprise prior to version 149.0.7827.53. This could lead to unauthorized access to sensitive information and modification of data within the browser context. There is no indication of availability impact or remote exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, limit physical access to affected devices and consider applying any available Chrome updates promptly.