Google Chrome’s New Tab Page contained insufficient validation of untrusted input. A malicious HTML page that is served to a renderer process can exploit this flaw to escape the browser sandbox. The vulnerability is classified as CWE-20 and would enable code execution outside the browser’s restricted environment. The likely attack vector is a crafted HTML page loaded by a compromised renderer process, as the description emphasizes untrusted input handling.

All Chrome releases older than 150.0.7871.47 are vulnerable, regardless of platform or channel. The issue applies to any deployment that allows a renderer process to load arbitrary HTML without proper sanitization. It is inferred that the vulnerability is platform-independent, as no specific OS is mentioned in the description.

The CVSS score of 9.3 indicates high severity, yet the EPSS score is below 1%, suggesting a very low likelihood of current exploitation. An attacker must first compromise the renderer process, which is not trivial, and no public exploits are documented. The vulnerability is not listed in the CISA KEV catalog, but because it facilitates sandbox escape, prompt remediation is advised. The absence of recorded public exploits is inferred from the description noting that none are documented, which implies exploitation is either not yet achieved or not widely reported.