Insufficient validation of untrusted input in extensions allowed a remote attacker who had already compromised the renderer process to achieve privilege escalation through a crafted HTML page. The flaw, related to improper input validation, enables the attacker to execute code with higher privileges within the renderer, potentially allowing arbitrary file writes or execution of malicious binaries on the host. The impact is high, as the renderer process can be used to modify system files or gain further elevated access.

Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability exists in the extensions subsystem and requires the attacker to have compromised the renderer process, but no specific product version details beyond the major browser release are available.

The CVSS score is not stated but the Chromium security team labels the issue as High severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires a prior compromise of the renderer process, suggesting a two-step exploitation chain: first gaining renderer control, then leveraging the unvalidated input to elevate privileges. Given the severity and lack of public exploitation data, the risk remains significant for systems where the renderer process can be subverted.