Chrome’s Network component lacks proper validation of untrusted input, allowing a compromised renderer process to process a crafted HTML page and escape the browser sandbox. This escalation permits execution of arbitrary code on the host machine, effectively yielding remote code execution. The flaw stems from an input validation weakness (CWE‑20) that can compromise confidentiality, integrity, and availability of the affected system.

Google Chrome browsers prior to version 151.0.7922.72 on any channel are affected. Users on the stable channel before the July 2026 update are at risk; all builds older than 151.0.7922.72 should be patched.

The CVSS score of 8.3 indicates a high severity vulnerability. With an EPSS score of < 1%, the likelihood of exploitation at this time is low, and the vulnerability is not listed in CISA’s KEV database. The attack vector requires an attacker who already has control of a renderer process, which typically implies a separate initial compromise or delivery of malicious HTML. While exploitation probability is modest, the potential impact remains severe owing to the sandbox escape.