This vulnerability arises from insufficient validation of untrusted input in the Notifications feature of Google Chrome before version 151.0.7922.72. An attacker who has already compromised the renderer process can exploit this flaw by using a specially crafted PDF file to perform a sandbox escape, potentially gaining higher privileges or executing arbitrary code outside the sandbox. The vulnerability is rated critical with a CVSS 3.1 base score of 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix is included in Chrome 151.0.7922.72.

Successful exploitation could allow an attacker with control over the renderer process to escape the sandbox, leading to potential full system compromise or execution of arbitrary code with elevated privileges. This impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

Users and administrators should update Google Chrome to version 151.0.7922.72 or later, where this vulnerability has been fixed. The vendor advisory from Google confirms the availability of this update. No additional mitigations are indicated by the vendor.