An input validation flaw in the Chrome Omnibox allows a remote attacker to craft network traffic that injects arbitrary scripts or HTML into the browser. This leads to a user‑interactive cross‑site scripting (UXSS) vulnerability, which can execute attacker‑controlled code in the context of the browser, potentially compromising user data or enabling further malicious actions. The weakness is identified as CWE‑20 (Unvalidated Input).

Google Chrome versions prior to 148.0.7778.96 are susceptible. The issue affects all builds on the stable channel that were released on or before the Chrome release announcement of the 148.0.7778.96 update. No variants or pre‑release channels have been reported as vulnerable beyond this version boundary.

The CVSS score of 6.1 indicates a medium severity vulnerability, and no EPSS score is currently available. The vulnerability is accessed remotely through normal network traffic without requiring privileged or local access, and it is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. Nonetheless, the potential for attacker‑initiated code execution remains realistic, especially in environments where untrusted network content reaches the client browser.