Insufficient validation of untrusted input in Chrome's Reading Mode allows a remote attacker who has compromised the renderer process to construct a crafted HTML page that can potentially escape the browser's sandbox. This flaw is an example of Improper Input Validation (CWE‑20) and a related data handling weakness (CWE‑1286). If successfully exploited, it could lead to execution of code outside the browser sandbox, compromising system integrity and potentially accessing local data. The Chromium security team rated the severity as Medium, indicating that the vulnerability is significant but not immediately catastrophic without prior renderer compromise.

The affected product is Google Chrome for desktop, versions earlier than 149.0.7827.53. This includes all standard Chrome releases installed on Windows, macOS, and Linux that have not been updated to the latest stable channel release. The vulnerability specifically targets the Reading Mode feature in these versions.

The flaw requires that the attacker already have compromised the renderer process before the sandbox escape can be triggered, so the attacker must first achieve a foothold in the browser context. The CVSS score is 9.6, indicating a high severity. EPSS score is less than 1%, and the vulnerability is not listed in CISA's KEV catalog, implying that widespread exploitation has not yet been observed. Nevertheless, any environment that enables Reading Mode and runs untrusted content should evaluate the potential for this vulnerability.