Improper input validation in the FileAPI component of Google Chrome allows a remote attacker to execute arbitrary code within the browser's sandbox by serving a specially crafted HTML page to the victim. The vulnerability is rated critical, indicating that exploitation could enable a malicious actor to run code that may be limited to the sandbox but can still compromise user data or facilitate further attacks such as sandbox escape or phishing.

Google Chrome browsers with a version prior to 156.0.8078.73 are affected. All users running earlier stable releases are vulnerable to the flaw.

The flaw is accessed remotely via a crafted HTML page, requiring only that the victim open or load the page in Chrome. The exploit is likely straightforward for a developer of malicious content, and because the vulnerability is in input validation (CWE‑20) it has a high likelihood of exploitation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability’s critical severity indicates a high potential impact for affected users. Based on the description, it is inferred that the attack vector involves a remote user loading a malicious HTML page in Chrome.