The vulnerability is an improper input validation flaw in the Core component of Google Chrome for Windows versions older than 156.0.8078.47. An attacker who has already compromised the renderer process can supply a specially crafted HTML page that triggers the validation error, enabling the attacker to potentially execute arbitrary code outside the sandbox. This flaw is classified as CWE-20. By bypassing input validation, the attacker may gain code execution or memory disclosure within the Chrome sandbox environment, depending on the context of the attack.

Affected systems are Microsoft Windows operating systems running Google Chrome version 156.0.8078.46 or earlier. All installations that have not yet upgraded to the stable channel update 156.0.8078.47 or newer are vulnerable.

The CVSS score is 6.5, indicating medium severity. The EPSS score is < 1 %, indicating a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires the victim to first compromise the renderer process, usually through a separate exploitation step or privilege escalation; thereafter the attacker can open a malicious web page to trigger the flaw. Because the flaw can permit code execution or memory disclosure once the renderer has been compromised, the risk remains moderate to high for environments that rely on Chrome as a secure browsing tool. Applying the available patch mitigates the issue entirely.