A type confusion flaw in ANGLE within Google Chrome allows a maliciously crafted HTML page, when delivered to a renderer that has already been compromised, to potentially execute code outside the renderer sandbox. This gives the attacker the ability to run arbitrary code on the host with the privileges of the Chrome process, bypassing the sandbox designed to contain browser activity.

The vulnerability affects Google Chrome browsers on all platforms running versions earlier than 155.0.8059.39. Versions 155.0.8059.39 and later include a fix that eliminates the type‑confusion condition in ANGLE.

EPSS information is not available, and the issue is not listed in the CISA KEV catalog. The Chromium security severity is labeled High, indicating a significant potential impact have already compromised the renderer process; without that foothold, the crafted page cannot escape the sandbox. While the attack surface is reduced by this prerequisite, the capability to execute code outside the sandbox remains serious, warranting prompt remediation. The CVSS score of 8.3 further underscores the high severity of this vulnerability.