The vulnerability in Chrome’s Keyboard component permits a remote attacker to inject arbitrary scripts or HTML into a crafted web page. This flaw can cause malicious code to run in the context of the victim’s browser session, potentially leading to credential theft, session hijacking, or defacement of the displayed web content. The weakness is classified as an inappropriate implementation that fails to validate or sanitize keyboard‑related input before rendering it, which aligns with common cross‑site scripting weaknesses.

Google Chrome versions before 149.0.7827.53 are affected. The issue was identified in the stable channel and addressed in the 149.0.7827.53 update released in June 2026.

Chromium rates this as a Medium severity vulnerability. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker delivering a specially crafted HTML page that leverages the keyboard handling code to execute arbitrary scripts. Exploitation requires user interaction with the page or simple page load, making it relatively straightforward for an attacker who can host a malicious page or embed malicious content in existing web sites.