Insufficient validation of untrusted input within Chrome DevTools allowed a remote attacker who had already compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. If successful, the attacker could execute code outside the renderer sandbox, elevating privileges and impacting the confidentiality, integrity, and availability of the host system. The weakness is rooted in input validation failures (CWE-20) and improper isolation leading to unauthorized resource access (CWE-1286).

The vulnerability affects Google Chrome versions earlier than 151.0.7922.72 across all operating systems. Users running the stable channel of Chrome on any desktop platform should verify their installed version against the fixed build.

Based on the description, the CVSS score of 5.8 classifies this as a medium‑severity flaw, whereas the EPSS score of less than 1% indicates a very low probability of exploitation. It is not listed in the CISA KEV catalog. The attack vector appears to be remote, as it requires an attacker who has already compromised the renderer process. A crafted HTML page delivered by a malicious site can trigger a sandbox escape. Since the exploit depends on prior renderer compromise, the overall risk to users who maintain secure browsing habits is inferred to be moderate but non‑negligible.