Insufficient data validation in Chrome’s Storage component allows a remote process to craft an HTML page that may trigger a sandbox escape. The flaw is identified as CWE‑122, indicating a buffer or bounds‑check oversight. Although the description does not confirm arbitrary code execution, the privilege escalation from within the renderer sandbox remains a concern.

All installations of Google Chrome running a version older than 150.0.7871.47 are affected, regardless of operating system. The vulnerability is present in the storage code that processes HTML in the renderer.

The CVSS score of 5.8 indicates a moderate severity, while the EPSS score of less than 1% signals a very low likelihood of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. The attack requires the attacker to first compromise the renderer process, typically by serving malicious web content, after which the poor data validation in the Storage component could enable a sandbox escape.