Insufficient input validation in Chrome’s navigation handling allows a remote attacker who has already compromised the renderer process to escape the browser’s sandbox by loading a specially crafted HTML page. The flaw is characterized by input validation weaknesses (CWE‑1286 and CWE‑20) and can lead to unauthorized execution of code with system‑level privileges. The official remark labels the issue as Chromium security severity High.

Google Chrome browsers prior to version 146.0.7680.153 on all supported operating systems (Windows, macOS, Linux).

The CVSS base score of 8.8 indicates a high likelihood of severe exploitation, while the EPSS score of less than 1% suggests that active exploitation is currently unlikely but possible. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, and it requires a remote attacker to have already gained control of the renderer process, typically through malicious web content. Once inside the renderer, the attacker can escape the sandbox and execute arbitrary code on the host system.