Google Chrome’s New Tab Page contained insufficient validation of untrusted input. A malicious HTML page that is served to a renderer process can exploit this flaw to escape the browser sandbox. The vulnerability is classified as CWE-20 and would enable code execution outside the browser’s restricted environment. The likely attack vector is a crafted HTML page loaded by a compromised renderer process, as the description emphasizes untrusted input handling.

All Chrome releases older than 150.0.7871.47 are vulnerable, inferred to be platform-independent. The issue applies to any deployment that allows a renderer process to load arbitrary HTML without proper sanitization. It is inferred that the vulnerability is platform-independent, as no specific OS is mentioned in the description.

The CVSS score of 9.3 indicates high severity, yet the EPSS score is below 1%, suggesting a very low likelihood of current exploitation. An attacker must first compromise the renderer process, which is not trivial. The CVE description does not state whether public exploits exist, so it is unclear if exploitation has been achieved. The vulnerability is not listed in the CISA KEV catalog, but because it facilitates sandbox escape, prompt remediation is advised.