Insufficient validation of untrusted input in WebSockets in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially escape the browser sandbox, which could enable execution of code with full system privileges. The weakness is categorized as CWE-1289 and CWE-20, indicating input validation failures and improper constraint handling, respectively. The attacker could embed a crafted HTML page that, when processed by the vulnerable renderer, may lead to privilege escalation or compromise of the host system.

Google Chrome browsers with versions prior to 151.0.7922.72 are affected. The vulnerability resides in the WebSockets implementation of the renderer process used by Chrome. Users running any Chrome build older than the specified release are at risk.

The CVSS score of 9.6 indicates a critical severity. The EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker already able to compromise the renderer process, which is typically less common and often requires additional conditions such as social engineering or a separate vulnerability. Nonetheless, the potential impact justifies prompt remediation.