Insufficient validation of untrusted input in the WebUI component of Google Chrome allows an attacker who can supply malicious network traffic to the browser to potentially escape the sandbox and execute code beyond the browser’s confines. The flaw is rooted in improper input validation (CWE‑20) and inadequate handling of data paths (CWE‑1286), leading to a medium‑high severity vulnerability. If exploited, an attacker could gain capabilities that exceed the permissions granted to the browser process, compromising confidentiality, integrity, or availability of the underlying system.

Google Chrome versions up to and including 151.0.7922.71 are affected; any installation of Chrome prior to the 151.0.7922.72 release is vulnerable and should be updated promptly.

With a CVSS score of 7.1, the vulnerability is considered medium‑high; the EPSS score of less than 1% indicates that active exploitation is unlikely at this time. The flaw is not listed in the CISA KEV catalog. The most probable attack vector is remote, wherein an attacker sends crafted traffic to the browser’s WebUI, potentially triggering the sandbox escape. No public exploit has been documented.