An input‑validation flaw in Chrome's desktop component allows a remote attacker to craft an HTML page that can execute arbitrary code outside the browser sandbox. The flaw is a classic CWE‑20 Boundary Error that, if exploited, gives the attacker full access to the host system, including reading, writing, and process execution, leading to complete compromise of the user’s machine.

The vulnerability exists in Google Chrome Desktop versions older than 155.0.8059.84 on all supported operating systems. Any machine running one of these versions and accessing a maliciously constructed web page is susceptible.

Chromium rates this issue as Medium severity. No CVSS score is published, and the EPSS value is unavailable. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. However, the attack vector requires the user to open or view a crafted HTML page, making phishing a likely delivery mechanism. Given the potential to escape the sandbox, the risk is moderate to high for exposed systems.