The vulnerability is a confused deputy flaw in Google Lens within Google Chrome. A remote attacker who has already compromised the renderer process can craft a malicious HTML page that causes the renderer to execute arbitrary code outside its sandbox. This breaks the confinement boundaries that Chrome normally relies on for rendering web content, potentially allowing the attacker to modify or exfiltrate data, or further elevate privileges on the affected system.

Google Chrome (stable channel) versions earlier than 155.0.8059.39 are affected. The issue was addressed in the 155.0.8059.39 release, which was posted on the official Chrome release blog and detailed on Chromium's issue tracker.

The vulnerability has a CVSS score of 8.3, indicating high severity, and its EPSS score is not available, indicating no current public exploitation statistics. It is not listed in the CISA KEV catalog. Exploitation requires the attacker to have already gained control over the renderer process, which usually means the attacker has compromised or tricked the user into loading a malicious web page. Once this foothold exists, the confusion of privileged actions can be leveraged to escape the sandbox and run code with higher privileges than the renderer normally possesses.