Insufficient validation of untrusted input in the ANGLE graphics layer of Google Chrome for Android before 150.0.7871.46 allows a remote attacker who has first compromised the renderer process to trigger a sandbox escape by serving a specially crafted HTML page. This flaw, a classic input‑validation defect (CWE‑20), could let attacker escape from the renderer sandbox to the host system, potentially granting unauthorized access to local files or system resources.

Google Chrome for Android versions earlier than 150.0.7871.46, which include the ANGLE component used for graphics rendering, are vulnerable. Any device running those versions and loading a malicious page after a renderer compromise is at risk.

Exploitation requires a prior compromise of the renderer process, and based on the description, it is inferred that a separate vulnerability is needed. Once the renderer is under attacker control, delivering a crafted HTML page exploits the input‑validation bug and can result in a sandbox escape. The EPSS score of < 1 % indicates a low probability of exploitation in the wild, but the CVSS score of 8.3 signals a high potential impact if the conditions are met. The flaw is not listed in the CISA KEV catalog, so there are currently no publicly known active exploits.