Google Chrome Safebrowsing state-validation flaw enables system access restriction bypass

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

• Google Chrome: affected before 153.0.8010.36. The structured record expresses the boundary as version 153.0.8010.36 with a less-than condition.
• No additional release branches, deployment-specific statuses, or other affected products are supplied.

The flaw is an improper state-validation condition in the Safebrowsing component of Google Chrome. At a high level, the component may process an invalid or unexpected state while handling attacker-controlled HTML; the specific state transition, code path, and implementation detail are not disclosed. The attacker-controlled input is a crafted HTML page, and the record describes remote reachability. The stated result is bypass of system access restrictions, but the record does not identify the specific restriction, resource, or browser function affected. Authentication requirements, attack complexity, and the exact user-interaction condition are not established.

The record describes remote reachability through a crafted HTML page. It does not state authentication requirements, user interaction requirements beyond the browser processing the page, or attack complexity. The supplied evidence does not confirm active exploitation, a public exploit, a named campaign, or an indicator of compromise. The practical exploitation status therefore remains unestablished from the available evidence.

The flaw may allow a crafted HTML page to interfere with Safebrowsing state validation and thereby bypass system access restrictions. The confirmed technical outcome is limited to restriction bypass; the record does not identify the resulting privilege, accessible resource, affected scope, or persistence capability. There is no basis to conclude that the issue enables code execution, privilege escalation, sensitive-data access, or impact on other systems. The organisational consequences depend on which restriction is bypassed and on additional controls in the deployment.

• The flaw may weaken access restrictions that Google Chrome or related system controls are expected to enforce while handling web content.
• If applications or policies rely on those restrictions, an attacker could obtain access beyond the intended boundary.
• The specific effect on data, functionality, or services is unknown because the source does not identify the target resource or access scope.
• The record provides no evidence that the issue directly causes arbitrary code execution, privilege escalation, or data disclosure.

1. Update Google Chrome to 153.0.8010.36, the version boundary identified by the record.
2. Verify the installed version on all managed endpoints after updating, including installations using separate release channels or packaging mechanisms.
3. If the environment uses another release branch, confirm applicability against Google's release data rather than assuming that every later or parallel branch has been verified by this record.
4. Until updates are deployed, reduce access to untrusted HTML pages according to existing operational policy. The record does not provide a more specific temporary mitigation.

• Inventory managed endpoints running Google Chrome and record the complete browser version.
• Identify installations running versions before 153.0.8010.36 for remediation priority.
• Check the Safebrowsing component in installations within the affected scope.
• Review browser or endpoint telemetry around processing untrusted HTML and events associated with access-restriction bypass. Treat this as precautionary monitoring, not as a vendor-confirmed indicator.
• Do not treat the absence of suspicious logs or events as proof that an installation is unaffected.