The vulnerability is a reflected cross‑site scripting flaw in the Chrome WebUI that lets a remote attacker inject and execute arbitrary JavaScript inside a privileged page. By creating a specially crafted HTML page and tricking a user into viewing it, the attacker can bypass the web origin policy and run code with elevated privileges within the browser context, potentially stealing data or executing further attacks. Based on the description, it is inferred that the attacker must entice a user to open the malicious page to trigger the exploit. The weakness is identified as CWE‑79, a type of input validation vulnerability. The documented severity is medium with a CVSS score of 6.1.

The affected product is Google Chrome. The vulnerability exists in all versions prior to 154.0.8037.92, but the exact version range is not provided in the CVE data.

The CVSS score of 6.1 indicates a medium impact, and the EPSS score is below 1%, suggesting a very low probability of exploitation at present. The vulnerability can be exploited by hosting a malicious HTML page that a user opens in Chrome, so the attack vector is web‑based and requires user interaction. Based on the description, it is inferred that the attacker must persuade a victim to open the malicious page to take advantage of the flaw. The vulnerability is not listed in the CISA KEV catalog, but the medium severity and the availability of a browser patch mean that the risk remains significant until the update is deployed.