Insufficient validation of untrusted input in the Web Authentication component of Google Chrome on Android allows a remote attacker who has already compromised the renderer process to craft a malicious HTML page that triggers the flaw, escaping the sandbox and potentially executing arbitrary code. The flaw is classified by Chromium security teams as high severity and maps to CWE‑20 and CWE‑807.

All installations of Google Chrome on Android running any version prior to 151.0.7922.72 are impacted. No other operating systems, browsers, or Chrome versions were identified as affected in the CVE description.

Attackers must first compromise the renderer process, then deliver a specially crafted HTML page that activates the vulnerability, after which they can escape the renderer sandbox and achieve arbitrary code execution. The CVSS score of 9.6 indicates a very high severity, but the EPSS score of <1% indicates that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. The CVE description does not explicitly state how many attack vectors are required beyond the renderer compromise, so any statement about the overall attack surface is an inference.