The vulnerability is a policy bypass in the Chromium Receiver component that allows a remote attacker who has already compromised the renderer process to escape the browser sandbox by loading a specially crafted HTML page. This can lead to execution of arbitrary code outside the browser process, compromising system confidentiality, integrity, and availability. The flaw is classified as a Medium severity problem within Chromium with the corresponding CVSS score of 5.8.

Google Chrome browsers older than version 151.0.7922.72 are affected. Any user running Chrome prior to this release on desktop platforms is vulnerable.

The CVSS score of 5.8 indicates a moderate risk level. The EPSS score is less than 1%, suggesting that exploit attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to achieve renderer process compromise, after which the crafted HTML can trigger the policy bypass and allow the attacker to escape the sandbox.