An inappropriate implementation of Blink in Google Chrome versions prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML into a rendered page. The flaw is a form of user‑interface cross‑site scripting (UXSS) that can execute malicious JavaScript in the context of the target user’s browsing session, potentially leading to data theft, credential compromise or exploitation of downstream vulnerabilities. It is characterized as CWE‑79: Improper Neutralization of Input During Web Page Generation.

Google Chrome browsers up to and including version 151.0.7922.72 are vulnerable. Any installation that can display externally supplied HTML is affected, regardless of operating system or deployment scenario. No specific operating system or network configuration is required beyond the ability to render a malicious HTML page in Chrome.

The CVSS score of 6.1 indicates a medium impact. EPSS is under 1 %, suggesting very low current exploitation likelihood. The flaw is not listed in CISA's KEV catalog. The most likely attack vector, as inferred from the description, involves a remote attacker hosting a malicious web page or providing a crafted HTML file; when a user opens that content in Chrome, the injected script runs with the user’s privileges. No special network or administrative privileges are required to exploit the vulnerability, making the attack path straightforward for a victim who visits the target page.