This vulnerability involves a policy bypass in the IFrameSandbox implementation in Google Chrome before version 147.0.7727.55. An attacker can exploit this by tricking a user into performing certain UI gestures, enabling navigation restrictions to be bypassed via a specially crafted HTML page. The issue is classified under CWE-693 (Protection Mechanism Failure). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows an attacker to bypass navigation restrictions in the browser sandbox, potentially leading to unauthorized actions that affect the integrity of the user's browsing session. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 147.0.7727.55 or later once confirmed. Until then, be cautious with untrusted web content that may attempt to exploit UI gesture interactions.