Google Chrome for Windows contains an insufficient validation flaw in the Chromoting component that can allow a remote attacker who has already compromised the browser’s network process to inject malicious input. This flaw can lead to a sandbox escape, thereby giving the attacker the ability to execute code beyond the browser’s constraints. The weakness is an insufficiency of input validation (CWE‑20) and a memory safety issue (CWE‑1289).

All installed instances of Google Chrome running versions earlier than 149.0.7827.53 on Windows are affected. The vulnerability applies to the Chromoting feature used for remote desktop functionality.

The CVSS score is 9.6, indicating a high severity, and the EPSS score is below 1%; the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is network traffic directed at the Chromoting service, and exploitation requires the attacker to already have control over Chrome’s network process. Because the flaw is limited to a sandbox escape, the risk is moderate; however, once the sandbox is broken the attacker could potentially gain full code execution within the user’s system.