An inappropriate implementation in Chrome's parser allows a remote attacker to bypass the content security policy by serving a crafted HTML page. The consequence is that a user who opens such a page can execute arbitrary scripts or load malicious resources despite the browser's CSP, potentially leading to data theft, malware injection, or session hijacking. This flaw is characterized by CWE-693 and CWE-791 weaknesses.

Google Chrome versions prior to 151.0.7922.72 are affected. All platforms using the default stable browser installation are at risk until the patch is applied.

The CVSS score of 4.3 classifies the vulnerability as low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires a user to visit a malicious web page that contains the crafted content; therefore the attack vector is a remote web-based phishing or social‑engineering scenario.