The vulnerability arises from insufficient validation of untrusted input in the Picture‑in‑Picture feature of Google Chrome on Android. A remote attacker who sends a crafted HTML page that triggers PIP can exploit the flaw to escape the renderer sandbox, potentially executing code with elevated privileges. This flaw is a remote code execution risk that compromises the isolation guarantees and the confidentiality, integrity, and availability of the browser environment. The weakness is reflected in CWE‑20 (Improper Input Validation) and CWE‑1286 (Unvalidated Input in Security‑Relevant Context).

Google Chrome for Android versions prior to 151.0.7922.72 are affected. Any device running these older releases can be compromised when a malicious web page activates Picture‑in‑Picture. The problem is specific to the Chromium‑based Chrome browser on the Android platform.

The CVSS score of 9.6 classifies this as a critical vulnerability, while the EPSS score of less than 1% indicates that, as of the latest assessment, exploitation has not been widely observed. It is not listed in CISA KEV, suggesting no known active exploits yet. Attacks would require a user to visit a malicious web page that initiates Picture‑in‑Picture; once the renderer process is compromised, an attacker may perform a sandbox escape. Given the high severity and remote nature of the exploit, the risk to organizations is high and the vulnerability warrants urgent attention.