The vulnerability stems from an improper implementation in the AdFilter module of Google Chrome, allowing a remote attacker to trigger arbitrary code execution within the browser’s sandbox through a specially crafted HTML page. The flaw does not require escaping the sandbox; it enables instructions to run inside the protected environment, potentially exposing sensitive information, modifying browser state, or enabling additional attacks. The impact is limited to the sandboxed context but could serve as a stepping stone for further compromise.

Google Chrome versions prior to 151.0.7922.72 on all desktop platforms are affected; the issue is fixed in 151.0.7922.72 and later releases distributed via the stable channel update in July 2026.

With a CVSS score of 8.8 the vulnerability is high severity. The EPSS score of less than 1% indicates a low current exploitation probability, and the flaw is not in the CISA KEV catalog. Attackers can exploit it by delivering a malicious HTML page that triggers the AdFilter bug while a user visits the page, allowing execution inside the sandbox without further credentials.