Insufficient validation of untrusted input within Google Chrome's DevTools component allows a remote attacker to run arbitrary code inside Chrome's sandbox by exploiting a malicious file opened by a user. The flaw is an input validation weakness identified by CWE-20. The likely attack vector is a malicious file opened by the victim after social engineering, which triggers the vulnerability. Successful exploitation grants the attacker code execution in a sandboxed environment and potentially local system compromise.

All users of Google Chrome before version 150.0.7871.47 are affected, as the flaw resides in the DevTools component of the desktop browser. No other products or OEM extensions are mentioned in the advisory.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% suggests a very low probability of exploitation (value lies in the (0%,1%) interval). The vulnerability is not listed in CISA KEV. Exploitation requires social engineering to convince a user to perform the specific UI gestures and open a malicious file. The high severity combined with low exploit probability emphasizes the need for prompt patching or other mitigations.