This vulnerability arises from insufficient validation of untrusted input in the omnibox of Google Chrome versions prior to 149.0.7827.53, allowing a remote attacker to inject arbitrary scripts or HTML into a crafted page that exploits UI gestures. The flaw, identified as CWE‑20, enables arbitrary script execution in the browser context, which can lead to data theft, credential compromise, or further malicious actions by the attacker.

The impact is limited to desktop versions of Google Chrome across all operating systems, affecting any build before the 149.0.7827.53 patch level. Consequently, users running any older Chrome stable releases are vulnerable until they upgrade.

Chromium classifies this issue with a Low security severity, and no EPSS score is available. The attack requires the victim to visit a malicious webpage and perform specific UI gestures, indicating that social engineering or user‑prompted actions are needed. While the exploit is theoretically possible, it does not require elevated privileges and there are no publicly documented exploits, resulting in a moderate but still non‑negligible risk for exposed users.