The vulnerability resides in the Dawn rendering engine of Google Chrome, where untrusted input is not adequately validated. A remote attacker could serve a specially crafted HTML page that may trick the engine into exiting its sandbox, thereby gaining higher privileges on the host. The issue is classified as high severity, reflecting the significant escalation potential should an exploit succeed.

Google Chrome versions prior to 149.0.7827.53 are affected. Users of the stable channel relying on a build before this update remain vulnerable until an update is installed.

The EPSS score is below 1%, and the flaw is not listed in the CISA KEV catalog, but the CVSS score of 9.6 indicates a high severity risk. Attackers would need to deliver the malicious HTML to the target, typically by directing the victim to a compromised webpage or through social engineering. If successfully exploited, the sandbox escape could enable code execution beyond the browser’s restricted context.