The vulnerability involves insufficient validation of untrusted input in Chrome extensions, permitting a remote attacker who gains control over the renderer process to elevate privileges through a specially crafted HTML page. This weakness maps to input validation failures (CWE-20) and improper handling of system resources (CWE-1289), enabling the attacker to execute privileged operations within the renderer and potentially compromise the confidentiality or integrity of data accessed by the browser.

Google Chrome desktop versions prior to 151.0.7922.72 are affected. The issue is observed in Chrome bundles delivered by Google, with no other vendors listed. Users running an older waterfall release must update to the latest stable version to eliminate the flaw.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious extension or a crafted HTML page served over the network, and the attacker must first compromise the renderer process to trigger the privilege escalation. As of now, no public exploitation has been reported, so the risk remains primarily theoretical.