An input validation flaw in Chrome's Autofill component enables a remote attacker to craft malicious network traffic that can escape the browser sandbox, potentially allowing execution of arbitrary code on the victim’s machine. The flaw is a classic example of CWE-20, misuse of user-supplied data that can lead to a loss of isolation between application components, and it also reflects CWE-501, insufficient authenticity of the received data.

All desktop installations of Google Chrome with versions earlier than 149.0.7827.53 are affected. The vulnerability spans every platform that uses the embedded Chrome engine compiled with the mentioned Autofill code.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation yet. The CVSS score of 9.6 indicates critical severity, which suggests the impact is significant. The attack vector requires the victim to receive malicious network traffic, so it is network‑based. While exploitation is theoretically possible, there is no publicly known exploit at this time.