Google Chrome for Android contains an input validation flaw in its WebView component. A crafted HTML page with malformed untrusted input can be parsed by a renderer process that has already been compromised, enabling the attacker to escape the sandbox that isolates the renderer from the rest of the system. This loophole permits potential execution of code outside the browser context, thereby threatening the confidentiality, integrity, and availability of the device.

The vulnerability affects Google Chrome on Android. Versions prior to 151.0.7922.72 are susceptible. Any Android device running these Chrome builds, and where an attacker can gain control of the renderer process, is at risk.

The CVSS score of 5.8 indicates a medium severity, while the EPSS score of less than 1% suggests that public exploitation is very unlikely. The issue is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to first compromise the renderer process, then deliver a malicious HTML page; therefore the attack surface is constrained compared to a direct remote code execution flaw. Nevertheless, a successful sandbox escape could allow the attacker to compromise the Android device.