Improper input validation in Chrome Desktop allows a crafted network packet to cause a renderer process to escape its sandbox, potentially enabling an attacker to execute arbitrary code beyond the normal security boundaries. The vulnerability is tied to CWE-20 and falls under a medium severity assessment in Chromium’s own reporting, yet the vector can lead to full system compromise if the sandbox is breached.

Google Chrome desktop editions prior to version 154.0.8037.57 are affected. Chrome’s presence on Windows, macOS, and Linux suggests that all desktop editions may be vulnerable; all users running the stable channel before the published update are potentially exposed.

The CVSS score of 8.3 denotes high severity, while an EPSS score is not available and the issue is not listed in CISA’s KEV catalog. The attack requires an attacker to have already compromised the renderer process; once the sandbox is breached, the attacker can run code with the privileges of the host system. Consequently, the overall risk is moderate to high, underscoring the need for a rapid remediation.