Improper input validation in ANGLE within Google Chrome on macOS allows a remote attacker to potentially run arbitrary code inside the browser’s sandbox through a specially crafted HTML page. The flaw is sufficient to execute code with the privileges of the sandboxed process, providing an attacker the ability to capture data, install malware, or pivot to higher‑privileged code within the system. The associated CWE is 20, indicating unsanitized input handling.

The vulnerability affects Google Chrome on macOS. Any installation running a version earlier than 156.0.8078.73 is susceptible. The issue is confined to the desktop channel and has not been reported for other operating systems or installation channels.

The vulnerability is classified as high severity. The EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so the exact exploitation probability is unknown. Because the flaw is triggered by a crafted HTML page, an attacker would need to lure the victim to a malicious site or supply a fake web page, which is a common vector for phishing or drive‑by compromises. Once the victim’s browser renders the malicious page, the crafted input can trigger the bug, leading to code execution within the sandbox. Given the high impact and the absence of an immediate patch at the time of discovery, the risk is significant for organizations that rely on Chrome for browsing or web‑based tasks.