The vulnerability is an inappropriate implementation in ANGLE within Google Chrome on Android prior to version 151.0.7922.72 that permits a remote attacker to escape the browser sandbox through a crafted HTML page. This flaw is classified as CWE‑501 and CWE‑693, indicating improper input handling and missing secure configuration. The description notes that sandbox escape is possible but does not explicitly state the outcome; based on typical implications of a sandbox escape, successful exploitation might enable the attacker to execute code with the same privileges as the web content or read device data.

Devices running Google Chrome for Android with a browser build older than version 151.0.7922.72 are affected. The issue applies only to this browser and does not extend to other browsers or components.

The CVSS score of 8.8 indicates a high severity level, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild at present. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious HTML page that a user visits or interacts with; this inference is drawn from the phrasing that a crafted HTML page can trigger the ANGLE bug. If sandbox escape is achieved, the attacker may gain privileges equivalent to the browser process, potentially compromising device security.