The vulnerability is an integer overflow in Google Chrome’s DevTools that allows a remote attacker to execute arbitrary code inside the browser sandbox. The flaw is rated high severity because the overflow can be triggered by a specially crafted HTML page, giving an attacker the ability to run code with the privileges of the user’s browsing session.

Any user running Google Chrome version 149.0.7827.53 or earlier on any platform is affected, as the flaw exists in all builds preceding the patched release.

Exploitation requires a victim to visit a malicious web page that drives DevTools code into the overflow scenario. The attack is remote, does not require local privilege escalation, and operates within the browser’s sandbox. EPSS data is not available and the issue is not listed in the CISA KEV catalog, yet the high CVSS score underscores the seriousness of this flaw. Attackers may use the code execution to exfiltrate data or pivot to more privileged operations.