Improper input validation in Google Chrome’s FileSystem component prior to 156.0.8078.47 permits a remote attacker—who has compromised the renderer process—to craft a malicious HTML page that enables execution of arbitrary code outside the sandbox. The flaw is classified as CWE‑20 and grants the attacker code execution privileges at the level of the renderer, potentially affecting the host system.

Google Chrome users on the stable channel for desktop installations who are running any version before 156.0.8078.47 are affected. The issue applies broadly across the operating systems supported by Chrome on desktop; no specific OS or device variants are mentioned.

The CVSS score of 8.8 indicates high severity. An EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present, and the vulnerability is not listed in CISA's KEV catalog, implying no documented exploitation. The likely attack vector is a maliciously crafted HTML page that a victim opens in the browser, which then invokes the vulnerable API and executes code outside the sandbox.