This vulnerability involves an inappropriate implementation in the File System Access API in Google Chrome versions before 149.0.7827.53. An attacker can bypass discretionary access control if a user is tricked into performing certain UI gestures on a maliciously crafted HTML page. The issue is classified under CWE-284 (Improper Access Control). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no explicit vendor advisory statement about patch availability or remediation level, and no known exploits in the wild.

The vulnerability allows an attacker to bypass discretionary access control, potentially leading to unauthorized modification of data (high integrity impact) without affecting confidentiality or availability. Exploitation requires user interaction via specific UI gestures, limiting the attack complexity. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation, users should update to version 149.0.7827.53 or later once available. Avoid interacting with untrusted web content that requests unusual UI gestures related to file system access.