Google Chrome (desktop) prior to 147.0.7727.55 contains a security issue in the “IFrameSandbox” mechanism that can allow a policy bypass. In plain terms, a remote attacker could get a user to perform specific UI gestures after visiting a crafted HTML page, and thereby bypass navigation restrictions that would normally be enforced by the sandboxing policy.
The Chromium security severity is described as Low in the provided NVD text, and the issue is framed as a “policy bypass” rather than a memory-safety flaw.
Technically, the problem is associated with Chrome’s IFrameSandbox policy enforcement. The attack vector described in the NVD text is social/interaction-based: an attacker must “convince a user to engage in specific UI gestures.” Once the user performs those gestures on the crafted HTML page, the sandbox’s navigation restrictions can be bypassed.
No further code-level details (e.g., specific functions, classes, or iframe sandbox policy checks) or a step-by-step exploitation workflow are included in the provided reference content. The provided references only indicate a stable-channel update page and a Chromium issue page link, but the scraped content does not include the technical root-cause details or any PoC methodology.
Impact is a bypass of navigation restrictions enforced by the IFrameSandbox policy. This could enable an attacker to navigate to destinations that should have been blocked by the intended sandbox policy, depending on the specific restrictions in place for the affected browsing context.
The provided information does not include a CVSS score, CVSS vector, or explicit impact categories such as RCE or data exfiltration. Based on the NVD text (“Chromium security severity: Low”), the real-world risk is likely constrained to policy enforcement bypass scenarios that require user interaction (specific UI gestures) and a crafted HTML page.
Mitigation: update Google Chrome (desktop) to version 147.0.7727.55 or later, as the vulnerability is stated to affect Chrome prior to 147.0.7727.55. No workaround details (e.g., specific browser flags or configuration changes) are present in the provided content.
Detection guidance is not available from the provided references. In general, defenders can reduce exposure by ensuring browsers are kept current and by monitoring for user interaction patterns that trigger navigation from sandboxed iframes, but the specific detection signals are not described in the supplied material.
poc_available: false (no PoC or exploit technique details were included in the provided reference content).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-693