Google Chrome had a flaw where the WebProtect component resolved references incorrectly, allowing a remote attacker who had gained control of the renderer process to inject crafted HTML that could run arbitrary code outside the sandbox. This vulnerability is an example of an improper restriction of XML or SOAP messages (CWE-706) that can compromise confidentiality, integrity and availability by elevating execution privileges. The description explicitly states that only a renderer process that has already been compromised is needed, so a local or remote compromise of the renderer process is a prerequisite for exploitation.

The affected product is Google Chrome, specifically all versions prior to 154.0.8037.57. No vendor‑specific patch level details beyond the version number are provided in the data.

The CVSS score of 8.3 classifies this flaw as high severity. The EPSS score is not available, so the likelihood of exploitation is unknown, but the vulnerability was only considered of low severity by Chromium internally. This flaw is not listed in the CISA KEV catalog and no exploits are publicly reported. The likely attack vector is the delivery of malicious HTML to the user, which requires that the renderer process is already compromised. It is therefore most relevant in environments where privileged renderer processes can be exploited or through supply chain attacks that insert malicious code into web content.