The vulnerability allows a remote attacker, who has already compromised the renderer process, to escape the process sandbox and execute arbitrary code on a Mac system running Google Chrome. This privilege elevation can lead to full system compromise, allowing the attacker to read or modify files, submit network requests outside the browser, or further install malware. The weakness is classified as CWE‑250, a failure to enforce proper access controls.

All installations of Google Chrome for Mac that use a version older than 155.0.8059.39 are affected. The issue exists across the stable channel and applies to any Chrome build that relies on the default renderer sandbox configuration for those versions.

The CVSS score of 8.3 indicates a high severity, and the EPSS score is not available. Attackers would need to serve a crafted HTML page that exploits the renderer process, after already gaining local code execution within that process. Because the condition requires a compromised renderer, the exploit is limited to environments where an attacker can inject malicious content into the browser, such as phishing sites or compromised web pages. The absence from KEV indicates no known widespread exploitation at this time, but the severity of privilege escalation warrants prompt remediation.