Google Chrome’s DevTools inadequately validates untrusted input, allowing an attacker who has already compromised the renderer process to escape the sandbox through a specially crafted HTML page. The flaw, identified as CWE–20 (Improper Input Validation) and CWE–807 (Improper Interaction of Application with the Operating System), can lead to execution of code with higher privileges than the sandboxed renderer, jeopardizing the confidentiality, integrity, and availability of the host system.

All users of Google Chrome running versions prior to 151.0.7922.72 are affected. The vulnerability applies to the stable channel and impacts all installations where DevTools is available and can be accessed by untrusted input.

The CVSS score of 9.6 classifies the issue as critical severity. The EPSS score of less than 1% indicates a very low probability of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. The attack requires an attacker to compromise the renderer process and deliver a crafted HTML page to it, suggesting that remote exploitation would likely involve phishing or malicious content that gains renderer access. Once the renderer is compromised, the sandbox escape can be used to run arbitrary code on the host.