Chromium’s DevTools lack sufficient input validation, permitting a remote attacker to craft a malicious HTML page that, when loaded into DevTools, forces the browser to navigate to arbitrary URLs without user consent. This weakness corresponds to CWE-20 (Improper Input Validation) and CWE-1286 (Failure to sanitize user-controlled input). The vulnerability is exploited through a file or web page opened inside DevTools; the attack relies on the victim entering DevTools and loading the crafted content. Based on the description, it is inferred that direct remote exploitation is not possible; the attacker must persuade the user to perform the interaction.

Google Chrome versions older than 151.0.7922.72 are affected, regardless of the operating system. The flaw resides in the core browser code, so all builds that ship that outdated version are impacted.

The CVSS score of 4.3 indicates low severity, and the EPSS score below 1 % suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s known‑exploited‑vulnerabilities catalog, and no widely‑available exploit exists. Because the attack requires the victim to open DevTools with a malicious page, the exploitability depends on social engineering and is limited to environments where a user is willing to inspect a page’s content in DevTools.