Insufficient validation of untrusted input in Google Lens lets a remote attacker who has already compromised the renderer process potentially escape the browser sandbox and gain higher privileges. The weakness is an improper input validation that can lead to a local privilege escalation, which could enable arbitrary code execution if the escape succeeds.

Google Chrome browsers older than version 151.0.7922.72 are affected. The flaw exists in all prior releases of the desktop stable channel where the renderer process handles untrusted content from Google Lens. The vendor is Google and the product is Chrome.

The CVSS score of 9.6 marks this flaw as high severity. An EPSS score of <1% indicates a very low probability that exploitation is occurring in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote; an attacker first must achieve code execution in the renderer process, then deliver a crafted HTML page that triggers the deficient validation to escape the sandbox. Although exploitation sightings are rare, the potential impact warrants prompt mitigation.