An inappropriate XML implementation in Google Chrome up to version 154.0.8037.56 allows a remote attacker to potentially execute arbitrary code within the browser sandbox through a crafted HTML page. The flaw stems from improper input handling of XML content, as identified by CWE-841, and can compromise the integrity of the system executing the browser. If exploited, the attacker could run malicious code confined to the sandboxed environment, which may be leveraged for further privilege escalation or data exfiltration.

Google Chrome browsers with a version earlier than 154.0.8037.57 are affected. All users running those releases on any platform must be considered potentially vulnerable until the update is applied.

The CVSS score of 8.8 indicates a high severity for this vulnerability. While an EPSS score is not available and the issue is not listed in CISA KEV, the potential for remote code execution makes it a significant risk. The likely attack vector involves a malicious or compromised web page that delivers specially crafted HTML containing XML constructs to the browser, enabling the code to run within the sandbox. As the flaw requires only that the victim load the crafted page, it is readily exploitable over the Internet.