Insufficient validation of untrusted input during Drag and Drop in Google Chrome on Android versions prior to 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to perform a sandbox escape. The vulnerability is a classic input validation flaw (CWE‑20) that could allow malicious code to execute with higher privileges than the renderer, potentially compromising device integrity and confidentiality.

Google Chrome for Android. Versions before 149.0.7827.53 are affected; no other product or version information is available at this time.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The reported Chromium security severity is Medium. Exploitation requires an attacker to first gain control of the renderer process, which may be achieved through other local or remote exploits. Once the renderer is compromised, the crafted HTML page can bypass input validation during drag‑and‑drop to escape the sandbox, enabling potential code execution with elevated privileges on the device.