A flaw in the untrusted input validation of the ANGLE graphics driver in Google Chrome allows a remote attacker to potentially execute code outside the browser sandbox by serving a maliciously crafted HTML page. This weakness (CWE‑20) can compromise the confidentiality, integrity, and availability of the host system. The vulnerability is triggered by an attacker delivering specially crafted content to a vulnerable Chrome user, enabling a sandbox escape and possible full-system compromise.

Google Chrome browsers built before version 149.0.7827.53 are affected. Users should verify their installed version and update accordingly.

The vulnerability carries a high severity rating. No EPSS score is available and the CVE is not listed in the CISA KEV catalog, indicating that while the flaw is serious, its exploitation prevalence has not yet been confirmed. An attacker would need to create a malicious HTML page and entice a user (or a vulnerable web page) to load it in the affected browser. This attack vector is remote and could be delivered via compromised websites or phishing emails, making it a significant threat to any system running an outdated Chrome browser.