Google Chrome on Windows suffers from insufficient validation of untrusted input in the GPU component, allowing a remote attacker who has already compromised the renderer process to craft a malicious HTML page that could escape the browser sandbox. This vulnerability is a classic boundary violation (CWE‑20) that can grant an attacker elevated privileges and potentially full system compromise if the sandbox escape succeeds. The descriptive severity is medium, yet the impact of sandbox escape translates to a high-privilege exploitation scenario.

All users running Google Chrome on Windows with a version earlier than 149.0.7827.53 are impacted, as the fix was backported in that release. The vulnerability applies to any renderer process that can be tricked with crafted content.

The CVE does not list an EPSS score and is not included in the CISA KEV catalog, but the attack requires remote code execution via a malicious HTML page and previously compromised renderer context. The nature of the flaw suggests a medium likelihood of exploitation in environments where browsers are exposed to untrusted web content. No publicly documented exploits exist, yet the high potential impact warrants immediate attention.