The vulnerability stems from improper input validation in the Skia graphics library used by Google Chrome. If a malicious actor serves a specifically crafted HTML page to a user, the input flaws can be exploited to run arbitrary code within the browser’s sandboxed environment. This flaw is a classic input validation weakness and is classified as CWE-20. The direct consequence is that an attacker could execute arbitrary code with the privileges granted to the browser process, potentially compromising the user’s system.

Google Chrome browsers built on the Skia engine prior to version 156.0.8078.73 are affected. Any installation of Chrome that has not yet been updated to version 156.0.8078.73 or later is vulnerable.

The issue is rated as High severity by Chromium’s security team. While the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the nature of the flaw—remote code execution via a web page—suggests that it could be readily exploitable by an attacker with a malicious website. The lack of publicly documented exploits does not diminish the risk, as the required conditions (a user visiting a crafted page) are common.