Insufficient validation of untrusted input in Chrome Settings on Windows allows a remote attacker who has already compromised the renderer process to perform a sandbox escape. The flaw results from improper input handling (CWE-20) and lets the attacker gain higher privileges than those granted to the isolated renderer, potentially allowing control of the Chrome process and the host operating system.

Google Chrome for Windows users running a Chromium release older than 150.0.7871.47 are affected. The vulnerability targets the renderer sandbox and does not rely on additional security features being disabled.

The CVSS score of 8.3 indicates a high severity for a sandbox escape, while the EPSS score of less than 1% implies that exploitation is very rare. Based on the description, it is inferred that an attacker must first compromise the renderer process before exploiting the sandbox escape, which reduces the immediate threat for users who have not been targeted yet. The vulnerability is not listed in CISA's KEV catalog, suggesting no widespread attacks have been observed.