An insecure handling of untrusted input within Chrome extensions can let an attacker who has already compromised the renderer process escape the sandbox and execute code with higher privileges. The flaw stems from insufficient input validation, a classic example of CWE‑20 (Improper Input Validation) and is further exposed by the way extension data is processed, matching CWE‑1286 (Improper Neutralization of Magic Bytes). If successfully exploited, the attacker gains the ability to bypass the renderer’s security boundaries and potentially affect the entire browser runtime.

Google Chrome versions prior to 151.0.7922.72 are susceptible, as the vulnerability exists in all Desktop releases before that update across operating systems supported by Chrome.

The CVSS score is 5.8, categorizing the vulnerability as medium severity. Its EPSS score is below 1 percent, indicating a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to identify or create a malicious HTML page that is rendered by a compromised renderer process; the attacker’s ability to influence the renderer process is the primary prerequisite. The exploit path is straightforward once the renderer is compromised, with no requirement for additional authentication or privileged access.