An improper implementation in the ANGLE graphics engine of Google Chrome for Android allows a remote attacker, who has compromised the renderer process, to escape the sandbox by serving a crafted HTML page. The vulnerability can lead to arbitrary code execution beyond the renderer’s restricted environment, effectively elevating privileges to those of the device or the user. This flaw is categorized as CWE-693, indicating insufficient security controls.

Google Chrome for Android versions prior to 151.0.7922.72 are affected. Devices running any older stable channel version of Chrome on Android may be vulnerable until they receive the 151.0.7922.72 update or later.

The CVSS score of 9.6 reflects the severity of a remote sandbox escape, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation. The likely attack vector requires an attacker to host a malicious web page that can be rendered by Chrome; thus, exposure to untrusted web content is a necessary condition. If exploited, the attacker could gain broad system-level access from the compromised application.