The vulnerability resides in the SiteIsolation component of Google Chrome on Windows and is caused by insufficient validation of untrusted input. If an attacker has already compromised the renderer process, a specially crafted HTML page can be used to escape that process’s sandbox. By breaking out of the sandbox, the attacker could gain higher privileges within the browser or access system resources, potentially enabling code execution outside the browser sandbox. This weakness is an improper validation of untrusted input (CWE‑20, CWE‑1289).

Google Chrome on Windows, versions prior to 149.0.7827.53, are affected. Version 149.0.7827.53 and newer no longer contain this flaw.

The CVSS score is 9.6 and the EPSS score is < 1%, but the vulnerability is still rated medium severity by Chromium. Exploitation requires pre‑existing compromise of a renderer process, limiting the attack surface. Because a direct remote exploit path is not provided, the probability of widespread use is moderate. The issue is not listed in the CISA KEV catalog. Updating to the latest stable release removes the vulnerability and Chrome’s automatic update mechanism ensures it is applied promptly.