Improper input validation (CWE‑20) in the Headless mode of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the sandbox by delivering a crafted HTML page. The flaw enables code execution while the browser is running in a restricted environment, thereby compromising the confidentiality or integrity of the system that hosts the headless instance. The vulnerability carries a high severity rating in the Chromium project's internal assessment.

The affected product is Google Chrome Headless. Versions prior to 156.0.8078.73 are vulnerable. All platforms that use Chrome Headless, such as automated testing or CI/CD pipelines, could be impacted if their browsers run at or below the vulnerable revision.

The CVSS score is not listed in the available data, but Chromium classifies this flaw as high severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a malicious HTML payload to a headless Chrome instance; as such, exposure requires the target to run headless Chrome with network access to an attacker‑controlled source. No credential or local privilege escalation is required, so potential damage can affect the host process. The absence of publicly disclosed exploits reduces the immediate risk but the high severity suggests a strong need for remediation.