The vulnerability arises from insufficient validation of untrusted input in the ANGLE graphics abstraction layer of Google Chrome. An attacker crafting a malicious HTML page that is served to or loaded by a user may exploit this flaw to escape the renderer sandbox and acquire privileges beyond the browser’s narrow sandbox. The weakness is classified as CWE‑20 and CWE‑1286, which allow untrusted data to influence privileged operations.

All users running Google Chrome versions prior to 151.0.7922.72 are affected. The flaw penetrates the stable channel of the browser, and any installation that has not yet received the patch remains at risk.

The CVSS score of 9.6 categorizes this flaw as critical; however, the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, indicating limited known exploitation. An attacker needs to supply a crafted HTML page—usually via social engineering or malicious web content—so the attack surface is narrow. Based on the description, it is inferred that successful exploitation could allow an attacker to escape the renderer sandbox and gain elevated privileges, potentially enabling arbitrary code execution.