A failure to validate untrusted input in the GPU component of Google Chrome allows a crafted HTML page to exploit the renderer process and potentially escape the browser sandbox. This weakness falls under the CWE-20 input validation flaw and the CWE-1286 sandbox escape vulnerability. If successful, the attacker could obtain the privileges of the Chrome process, potentially enabling broader compromise of the Android device.

Google Chrome on Android versions prior to 151.0.7922.72 are affected. The vulnerability is present in the Chrome browser’s GPU components before the 151.0.7922.72 release.

The CVSS score of 8.3 indicates a high severity, but the EPSS score of less than 1% suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver a malicious web page that compiles the renderer process in order to trigger the sandbox escape. Once executed, the sandbox violation could provide the attacker with device‑level capabilities.