The flaw stems from inadequate validation of untrusted data within Chrome’s ANGLE graphics layer. This oversight can allow an attacker who provides a specially crafted HTML page to escape the browser sandbox, potentially executing code outside the protected environment. The vulnerability aligns with CWE‑20 (Improper Input Validation) and CWE‑1286 (Improper Validation of Data or Parameter Checks).

The issue affects all Google Chrome (Chromium) installations running a build prior to version 151.0.7922.72. Users on those legacy builds are susceptible to sandbox escape if they open or render malicious web content.

The CVSS score of 9.6 indicates a critical severity, while the EPSS score of less than 1% points to a low likelihood of exploitation in the wild. The vulnerability can be triggered remotely by an attacker who supplies a crafted HTML page that the victim’s browser processes. As of now the flaw is not listed in CISA’s KEV catalog and no widely known exploits are public.