Google Chrome versions prior to 151.0.7922.72 contain an insufficient validation of untrusted input in Developer Tools. The flaw allows a remote attacker to craft an HTML page that, when processed by DevTools, bypasses navigation restrictions normally enforced by the browser. This can enable an attacker to redirect the user to arbitrary URLs or inject disallowed navigation requests, potentially compromising the user’s browsing context or facilitating social‑engineering attacks. The weakness is classified as CWE‑20 (Improper Input Validation) and CWE‑1286 (Unchecked Input Source).

The issue affects Google Chrome on desktop platforms. All releases older than 151.0.7922.72 are vulnerable; the fix is delivered in Chrome 151.0.7922.72 and later updates.

The vulnerability carries a CVSS score of 4.3, indicating low overall severity. The EPSS score is below 1%, implying a very low likelihood of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector involves a remote attacker delivering a crafted HTML page that a user loads into DevTools; this scenario requires user interaction or that the victim opens the malicious page in a context where DevTools is active. If the user follows the attack path, navigation restrictions can be overridden, providing limited but potentially harmful control over the browsing session.