A vulnerability in the Dawn graphics engine of Google Chrome allows an integer overflow when parsing a crafted HTML page. The overflow can occur in the renderer process and may lead to a sandbox escape, giving an attacker the ability to execute code outside the browser sandbox. This can potentially result in full system compromise by executing arbitrary code with elevated privileges, as the vulnerability grants the attacker Remote Code Execution capabilities.

All users running Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability was reported in the stability channel release notes for June 2026, so any platform that runs the affected Chrome build is at risk.

The CVE is rated high in Chromium severity and is not listed in the CISA KEV catalog. The CVSS score of 8.3 indicates a high severity. No EPSS score is available, so the exploitation probability is not quantified. The likely attack vector requires an attacker to compromise the renderer process, which typically involves tricking a user into visiting a malicious web page. Once the renderer process is compromised, the integer overflow can promote the attacker to a sandbox escape, enabling remote code execution with potentially system-level privileges.