Improper input validation in Google Chrome’s ReadingList component enables a remote attacker to craft an HTML page that can cause the browser to execute arbitrary code inside its sandbox. The flaw is a classic input validation error that undermines the sandbox and can compromise confidentiality, integrity, and availability if exploited.

Users of Google Chrome versions earlier than 156.0.8078.73 on any platform with the ReadingList feature enabled are affected. The vulnerability applies to the desktop stable channel builds prior to the specified version; no operating system or device is explicitly excluded.

The CVE does not provide a CVSS or EPSS score, but it is classified as high severity by Chromium. The lack of a KEV listing indicates no confirmed exploitation reports yet, yet the potential for arbitrary code execution makes the risk significant. The likely attack vector involves a crafted webpage that the user opens locally or visits, triggering the flaw and bypassing the sandbox restrictions.