The flaw is an improper input validation in the compositing subsystem of Google Chrome before version 156.0.8078.73. A maliciously crafted HTML page can reach the compositor and bypass the browser sandbox, potentially allowing a remote attacker to run arbitrary code on the victim’s machine. This is a classic input validation error (CWE‑20) that could compromise confidentiality, integrity, and availability of the affected system.

All users running Google Chrome versions earlier than 156.0.8078.73 are impacted. The vulnerability resides specifically in the compositing component of those releases, regardless of platform.

Chromium rates the issue as high severity. Because the attack vector requires delivering a specially crafted web page to the target, the exploitation is remote and does not need local privileges. The EPSS score is not available, but the absence from the CISA KEV catalog indicates no public exploit was reported at the time of this analysis. The risk remains high until the vendor releases a patch, and the likelihood of exploitation is elevated if users remain on vulnerable versions.