The vulnerability arises from malformed reference resolution within Google Chrome's DevTools. A crafted HTML page can cause a remote attacker, typically via social engineering, to gain control over code execution outside Chrome's sandbox, allowing the attacker to execute arbitrary code on the target machine. This weakness is identified as CWE-706, where indirect trust is incorrectly granted.

Google Chrome users running versions prior to 157.0.8103.38 are vulnerable. It has been noted that all earlier releases of the stable channel are affected.

Although the EPSS score is not available, the vulnerability carries a medium severity rating from Chromium. The attack vector requires a remote user interaction—clicking a malicious link or loading a crafted page—yet once triggered, it permits sandbox escape and maximal impact. Because this flaw is not listed in the CISA KEV catalog, there is no known large‑scale exploitation yet, but the potential for broad damage remains if social engineering succeeds.