This vulnerability in Chrome on Windows (patched in 151.0.7922.72) deserves more attention than its 'Medium' vendor rating suggests. The critical context that changes everything: Chrome on Windows runs with elevated token privileges that most defenders don't realize exist. When a malicious file reaches Chrome's file handling code paths, that file isn't just crashing a browser—it's interacting with a process that has access Windows expects only from system components.
The 'local attacker' prerequisite in the CVSS vector isn't a mitigation—it describes post-breach conditions standard in enterprise environments. Once any medium-integrity compromise exists (malicious extension, dropped malware, weaponized macro), Chrome's elevated context becomes the next escalation target. In typical AD-joined Windows deployments where Chrome operates adjacent to elevated operations, the 'local access' requirement collapses into a description of normal post-breach movement.
The NVD-Chromium severity disagreement (7.8 vs Medium) reflects different measurements, not conflicting risk assessments. Chromium's rating encodes the narrow exploit conditions; NVD weights the consequence once those conditions exist. Both are correct, which means your prioritization should depend on your environment: if you have robust endpoint controls preventing the initial local access, this is manageable. If your environment assumes Chrome is a trusted client rather than a privileged process handling untrusted input, this is a direct escalation pathway.
Practical steps: verify your Chrome version is 151.0.7922.72 or later immediately—this is a patch, not a configuration change. Audit your Chrome deployment for enterprise policies that might restrict file handling (such as disabling file:// URL navigation or restricting download locations). The vulnerability likely involves a specific file handler or drag-and-drop code path—once Chromium publishes the diff, identify which Chrome features your organization uses that map to that code path and treat those as your actual attack surface.