Insufficient validation of untrusted input occurs during drag‑and‑drop operations in Chrome on Android, allowing a remote attacker who has already compromised the renderer process to potentially escape the browser’s sandbox. The flaw is a classic input validation weakness (CWE‑20) combined with improper handling of trust boundaries (CWE‑807). If successfully exploited, malicious code could execute with higher privileges, threatening device integrity and confidentiality.

Google Chrome for Android devices running any version before 149.0.7827.53 are vulnerable. No other browsers or products are reported to be affected at this time.

The CVSS score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the current environment. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to first gain control of the renderer process, after which a crafted HTML page can trigger the drag‑and‑drop handling bug to escape the sandbox, potentially enabling code execution with elevated privileges on the device.