Chrome's Dawn rendering engine on Android performs insufficient validation of untrusted input in versions prior to 150.0.7871.47. If the renderer process is already compromised, the attacker can deliver a specially crafted HTML page that may trigger a sandbox escape, allowing code to execute with privileges higher than those normally granted to the renderer process. The vulnerability is defined by CWE-20, indicating an input validation failure. Although the description references a 'potential' escape rather than a guaranteed outcome, the existence of this flaw could lead to full system compromise if successfully exploited.

Google Chrome for Android installations running any build before version 150.0.7871.47 are vulnerable. All affected devices should consider their Chrome version and apply the update as soon as it becomes available.

The flaw carries a CVSS score of 9.6, indicating very high severity. The EPSS score is reported as less than 1%, indicating a low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV. If the attacker controls the renderer process and can supply malicious HTML to the target, the risk is severe, providing the attacker with elevated privileges and potentially full system compromise.