An insufficient validation of untrusted input within Google Chrome's DevTools allows a remote attacker who convinces a user to perform specific UI gestures to inject malicious code. The injected input is executed inside a sandboxed environment, resulting in arbitrary code execution that may compromise the local system or elevate privileges. This flaw relies on the developer tools interface and therefore requires user interaction with the browser. The weakness is a classic input validation flaw as identified by CWE-20.

All users of Google Chrome before the 150.0.7871.47 stable channel update are affected. The vulnerability exists in the DevTools component of the desktop browser. No other products or OEM extensions are mentioned in the advisory.

While the EPSS score is not available and the vulnerability has not been listed in CISA's KEV catalog, the advisory reports a medium severity rating by Chromium. The exploitation path requires a social engineering element for the user to perform specific UI gestures, but once achieved, the attacker can run arbitrary code within the sandbox. The lack of an EPSS figure suggests limited publicly available exploitation code, yet the known medium severity underscores the need for prompt patching or mitigation.