An insufficient validation of untrusted input in the Downloads component of Google Chrome was discovered, enabling a remote attacker to execute arbitrary code through a specially crafted HTML page. The flaw can be classified as CWE-20 and CWE-79, where input is not properly checked before it is processed. The direct consequence for an affected user is the potential compromise of the entire system, allowing an attacker to run malicious code with the privileges of the browser process.

Google Chrome browsers older than version 148.0.7778.168 are affected. The vulnerability exists in the Downloads feature across all platforms supported by the Chrome stable channel.

At the time of analysis EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no widely known exploitation at this moment. Nevertheless, because the flaw permits remote code execution via a crafted web page, it presents a high severity risk to any system that manually opens or automatically loads such content. A CVSS score of 8.8 further highlights the severity. An attacker can embed malicious code in a page served from any domain, and the attack vector is the user’s interaction with that page—typical of web‑based exploitation.