An inappropriate implementation in Chrome’s DevTools component allows an attacker who has already compromised the renderer process to inject arbitrary scripts or HTML into a privileged page via a crafted HTML page. The flaw is a code injection vulnerability (CWE‑79 and CWE‑94) that can lead to privilege escalation within the browser if the attacker succeeds in compromising the renderer process.

All versions of Google Chrome prior to 151.0.7922.72, including the stable desktop channel, are affected. The defect exists in the DevTools component that is available in both consumer and enterprise deployments.

The CVSS score of 6.1 indicates medium severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker first to compromise the renderer process, typically by delivering a malicious web page or by leveraging a separate browser vulnerability. Once achieved, the attacker can inject scripts or HTML into privileged pages, potentially leading to cross‑site scripting or privilege escalation within the browser window.