Insufficient validation of untrusted input in the Back‑Forward Cache (BFCache) component of Google Chrome allowed a remote attacker who had already compromised the renderer process to potentially escape the sandbox through a crafted HTML page. This lapse is associated with CWE‑1286 and CWE‑20 and could enable the attacker to execute code with higher privileges than the renderer normally permits, as indicated by the medium severity rating.

All Google Chrome users running a version earlier than 151.0.7922.72 are impacted, regardless of operating system. The flaw applies to the BFCache implementation on Windows, macOS, and Linux builds. No narrower platform scope was identified.

The CVSS score of 8.7 denotes a high severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation at present. This issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to deliver a malicious web page or resource that the compromised renderer processes before BFCache validation takes place, suggesting the attack vector is a remote website or embedded content that can trigger the renderer. Because the attacker must first gain influence over the renderer, the risk is moderated by the necessity of a prior compromise step.