Insufficient validation of untrusted input in Chrome DevTools permits a remote attacker to exploit a crafted HTML page that, when a user engages specific UI gestures, bypasses built‑in navigation restrictions. The vulnerability is a classic input validation flaw (CWE‑20) coupled with a configuration error (CWE‑807), allowing the attacker to redirect a user to malicious sites or content that would otherwise be blocked. This could facilitate phishing or other social‑engineering attacks by making the user believe legitimate navigation control still applies.

The flaw exists in Google Chrome versions prior to 151.0.7922.72. Users running any earlier Chrome release are vulnerable until they update to the fixed release. No other vendors or product versions are mentioned in the CNA data.

With a CVSS score of 6.5 the vulnerability is classified as medium severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. Exploitation requires a remote attacker to persuade a user to interact with a specific crafted page and perform UI gestures, making it difficult to automate and unlikely to see widespread deployment.