Improper input handling in the WebRTC component of Google Chrome versions prior to 156.0.8078.73 permits a remote adversary to supply a specially crafted HTML page that is parsed without proper validation. Once the input is processed, the attacker can execute code that runs inside the browser sandbox, potentially breaking the sandbox. The flaw is classified as high severity and is identified as CWE‑20.

Google Chrome desktop browsers shipped before 156.0.8078.73 are susceptible. All builds that included the vulnerable WebRTC code up to the 156.0.8078.73 release must be considered at risk.

The absence of an EPSS score and no listing in the CISA KEV catalog indicate that the vulnerability has not yet been widely exploited, but its high severity rating signals a serious threat. The most likely attack vector is a malicious or compromised website that serves a crafted HTML document to a user’s browser, triggering the flaw remotely. Because the issue stems from input validation, it can be triggered without local user interaction, and if sandbox escape succeeds, the attacker could gain elevated privileges, amplifying the risk to systems relying on Chrome for sensitive browsing.