The flaw results from insufficient validation of untrusted input in the Save to Drive feature of Google Chrome. If an attacker can already compromise the renderer process, a malicious PDF crafted specifically for this vulnerability may trigger a sandbox escape, allowing code execution outside the protected renderer context. The vulnerability carries a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

This vulnerability affects Google Chrome versions older than 151.0.7922.72, which are being shipped with the flawed Save to Drive implementation. Users running those builds are exposed to potential sandbox escapes when they open a crafted PDF while the renderer process is compromised.

The EPSS score of less than 1% suggests a low overall exploitation probability, but the requirement of an already compromised renderer process means that the attack vector is remote, usually achieved through drive‑by exploitation or malicious PDF delivery. The high CVSS score reflects the severe compromise risk, and the vulnerability is not listed in the CISA KEV catalog.