The vulnerability is an inappropriate implementation in the CSS rendering engine of Google Chrome before version 151.0.7922.72, which permits a remote attacker to inject arbitrary scripts or HTML via a crafted page. This flaw results in a user‑interaction cross‑site scripting (UXSS) condition, classified as CWE‑79, that could allow code execution in the attacker’s context, enabling theft of credentials, session hijacking, or malware deployment. The flaw is active only when the victim interacts with the malicious content in the browser. The description does not specify an administrative privilege requirement, so the attack affects regular users who open a malicious page.

All installations of Google Chrome older than 151.0.7922.72 on supported platforms are affected. The issue appears in the stable channel, meaning any user who has not yet received the 151.0.7922.72 update on any supported operating system is vulnerable. The vulnerability is tied to the CSS engine and is not limited to a specific feature or module beyond the core rendering pipeline.

The overall CVSS score of 6.1 denotes medium severity. The EPSS score of less than 1% suggests that, as of now, exploitation attempts are uncommon. The vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to require delivery of a maliciously crafted HTML page—either through a compromised website, a phishing email, or by a local file that the user opens—followed by user interaction with that page.