The vulnerability resides in Chrome’s Network module and allows a remote attacker to inject arbitrary script or HTML into the browser’s user interface through a specially crafted HTML page. This is a CWE‑79 flaw that can lead to execution of malicious code in the context of the browser, enabling the attacker to hijack user sessions, exfiltrate data, or modify page content. The flaw does not require elevated privileges; it can be triggered simply by a user visiting the fake page, making the integrity of the UI and any data processed by the browser at risk.

Any installation of Google Chrome running a version older than 150.0.7871.47 on any operating system, including stable channel users, is vulnerable. The issue affects all users who might browse a malicious site that serves the crafted page.

The CVSS score of 6.1 classifies the flaw as moderate. The EPSS score of less than 1% indicates that attacks are currently rare but possible. Because the vulnerability can be triggered through ordinary web browsing without special access, it can potentially affect all users who visit a malicious page. The flaw is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed yet.