An incorrect CSS handling routine in Google Chrome versions prior to 150.0.7871.47 permits a remote attacker to inject arbitrary scripts or HTML when a crafted web page is loaded. The result is a form of User‑Experience Cross‑site Scripting that allows the attacker to execute code in the victim’s browser context, though it does not grant system‑level privileges.

All desktop installations of Google Chrome running a version earlier than 150.0.7871.47 are vulnerable. The issue applies to the stable channel, but this assumption is inferred from the release notes and is not explicitly stated in the advisory. Standard consumer users who have not applied the latest security update are at risk.

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been documented. The CVSS score of 6.1 classifies it as low severity from the Chromium perspective, yet the attack vector is remote and requires a victim to visit a maliciously crafted page. Timely remediation is important to prevent potential exploitation.