The flaw involves improper input validation in Google Chrome’s command processing, allowing a maliciously crafted HTML page to escape the browser’s sandbox and run arbitrary code. An attacker can achieve full system compromise, affecting confidentiality, integrity, and availability.

Chrome browsers prior to version 156.0.8078.73 on any platform that renders web content are vulnerable. Users who have not yet upgraded on Windows, macOS, Linux, or other operating systems should bring their installations to this version or newer.

Chromium labels the issue as high severity, yet no EPSS data is available and it is not listed in CISA KEV, indicating no confirmed exploitation at the time of disclosure. Attackers most likely need to host a malicious page and persuade a user to open it; however, remote exploitation via a crafted URL is possible. Without an official workaround, upgrading remains the only reliable mitigation.