A flaw in how Google Chrome validates untrusted UI input on Linux and ChromeOS allows a remote attacker to execute arbitrary code, but only when the user performs a specific series of UI gestures after visiting a malicious HTML page. The vulnerability is an input validation weakness (CWE‑20) and is rated medium in Chromium’s severity assessment.

The issue affects Google Chrome on Linux and ChromeOS platforms, impacting all versions before 148.0.7778.96. No post‑148.0.7778.96 releases are mentioned to be vulnerable.

Because exploitation requires user interaction with a crafted web page and deliberate UI gestures, the attack surface is limited but the potential impact remains arbitrary code execution. The CVSS score of 8.8 indicates a high severity, whereas Chromium rates the flaw as medium. The EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, and the vendor’s security team has marked the flaw as medium severity. A successful exploit would give the attacker the same privileges as the logged‑in user on the affected device.