In Google Chrome versions prior to 150.0.7871.47, an improper handling of CSS within the rendering engine enables a remote attacker to inject arbitrary scripts or HTML through a crafted web page. This flaw can lead to the execution of attacker–supplied JavaScript, potentially compromising user data, session hijacking, or other malicious actions. The vulnerability is classified as a high‑severity cross‑site scripting issue, consistent with CWE‑79.

The affected product is Google Chrome, specifically the desktop stable channel. Versions from the beginning of Chrome’s history up to and including 150.0.7871.46 are vulnerable. Users running Chrome 150.0.7871.47 or newer are not affected.

The EPSS score is not available, but the issue is listed as a high‑severity vulnerability with no current presence in CISA’s KEV catalog. The likely attack vector is remote; an adversary can deliver a maliciously crafted HTML page or file that a victim opens in Chrome. The vulnerability directly exposes the browser’s rendering process, enabling execution absence of a publicly documented exploit and the requirement for a page to be opened by the user, the current exploitation risk is moderate, yet it remains critical for any environment that processes untrusted web content.