The vulnerability lies in the Skia graphics library used by Google Chrome, where insufficient input validation allows a crafted HTML page to trigger arbitrary code execution within the browser's sandbox. If exploited, an attacker could run code in the sandboxed environment, potentially leading to further compromise of the user's machine if the sandbox is broken. The weakness is categorized as CWE‑20: Improper Input Validation.

This flaw affects Google Chrome prior to version 156.0.8078.73 across all platforms where Skia is enabled. The affected products are Chrome browsers that include the Skia graphics stack, and the specific vulnerable version range ends at 156.0.8078.72. Users of newer releases are not impacted.

The documented severity is Critical, indicating a high likelihood of serious exploitation. EPSS scoring is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, achieved by serving a malicious HTML page over the network to a victim’s browser. An attacker must first be able to get the user to view the crafted page; no local privilege is required at this stage. If successful, code runs within the sandbox process of Chrome, which may still provide isolation but offers a foothold for further attacks.