Technical impact
The flaw resides in Google Chrome’s GPU component on Windows, where untrusted input is insufficiently validated. After compromising the renderer process, an attacker can craft a malicious HTML page that triggers the vulnerability, potentially escaping the browser sandbox. This boundary violation (CWE‑20) can elevate privileges or allow full system compromise if the escape succeeds. The CVE notes a Medium severity from Chromium, yet the CVSS score of 9.6 indicates a high potential impact.
Affected Systems
Chrome users on Windows running a version older than 149.0.7827.53 are affected because the fix was backported in that update. Any installation that allows the renderer to load untrusted web content is at risk. All Windows desktop versions with Chrome remain in scope until the upgrade is applied.
Risk and Exploitability
With a CVSS score of 9.6 and an EPSS score below 1%, the vulnerability is high severity but its exploitation likelihood is low, as it requires prior renderer compromise. It is not listed in the CISA KEV catalog, indicating no known active exploitation. The attack vector is inferred from the description: a remote malicious HTML page that feeds untrusted data into the GPU path after the renderer has been compromised.
Debian DSA