The bug arises from an inadequate processing of CSS in older Chrome versions, letting an attacker embed arbitrary scripts or HTML into a page through a specially crafted web document. This flaw facilitates a user interface cross‑site scripting attack, permitting the execution of attacker‑controlled code in the victim’s browser context and potentially exfiltrating data or performing malicious actions on the user’s behalf. The weakness is formally cataloged as CWE‑79.

Google Chrome browsers prior to version 151.0.7922.72 are affected. Any installation of Chrome before this release, regardless of operating system or language pack, is vulnerable unless patched.

The CVSS score of 6.1 reflects a moderate severity, while an EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires only a crafted HTML page accessible to the user, making it a remote attack vector that is feasible through social engineering or malicious websites. The impact is limited to the user context; there is no direct privilege escalation or system compromise.