An insufficient validation flaw in Google Chrome’s DevTools allows an attacker who has already gained control of the renderer process to inject arbitrary scripts or HTML into a crafted page. This could lead to malicious code execution within the context of the renderer, effectively enabling user‑side cross‑site scripting or other malicious actions.

Google Chrome versions earlier than 149.0.7827.53 are affected. The flaw exists in the Chrome browser for desktop platforms.

The CVE has a high severity rating in Chromium’s internal scoring model, but no EPSS data is currently available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to first compromise the renderer process, likely through a malicious web page or exploit. Because no public exploits have been reported, the risk is limited to environments where an attacker can execute arbitrary renderer code.