An improper input validation flaw in the browser engine of Google Chrome allows a remote attacker who has already compromised a renderer process to trick the network handling code into executing arbitrary code outside the renderer sandbox. This flaw enables the attacker to run code with privileges higher than those granted to typical renderer processes, effectively breaking out of the security isolation that Chrome normally provides.

All installations of Google Chrome running a version older than 157.0.8103.38 are impacted, regardless of operating system. The vulnerability resides in the core browser component that parses network traffic for renderer processes and therefore affects any user or organization that has not upgraded to the fixed version.

The vulnerability provides a clear path for a remote attacker to achieve arbitrary code execution once they control the renderer. Although a CVSS score is not publicly published, Chromium reports a medium severity, and the lack of EPSS data means the exploit probability is currently unknown. The flaw is not yet listed in the CISA KEV catalog, but the ability to craft malicious network traffic that causes sandbox escape indicates a manageable network‑based attack vector once a renderer is compromised.