The vulnerability arises from an incorrect comparison in font handling logic within Google Chrome versions prior to 155.0.8059.39. An attacker may craft a malicious HTML page that triggers the flaw, potentially executing arbitrary code inside the browser's sandbox. This flaw, categorized under CWE-697, could lead to compromise of confidentiality, integrity, or availability of the affected system if an attacker gains the ability to run code within the sandbox environment.

This issue affects Google Chrome on all platforms for which versions older than 155.0.8059.39 are still in use. Enterprises relying on legacy browser configurations or users who have not installed the latest stable channel update are exposed to the risk.

With a CVSS score of 8.8, this vulnerability is considered high severity. The EPSS score is currently unavailable, and the vulnerability is not yet listed in CISA's KEV catalog, suggesting no confirmed widespread exploitation as of now. However, the attack vector is likely a crafted local or remote HTML page that a user opens, making the threat realistic for users who visit untrusted sites or open malicious documents. The lack of a public exploit does not preclude future exploitation, and the sandbox escape potential warrants prompt mitigation.