The vulnerability arises from an improper cast in the Dawn rendering engine, leading to an out‑of‑bounds write (CWE‑125). This flaw allows a remote attacker to craft an HTML page that, when opened in Chrome, grants arbitrary code execution inside the browser's sandbox. The attack can compromise the confidentiality, integrity, or availability of the sandboxed process, and potentially elevate to full system compromise if the sandbox is bypassed.

This issue affects Google Chrome browsers version 149.0.7827.x and earlier on all supported operating systems, including Windows, macOS, and Linux. The vulnerability does not exist in newer releases of Chrome that include the patch contained in version 149.0.7827.53.

The CVSS score is 8.8, indicating high severity. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog, suggesting that it has not yet been widely exploited. An attacker would need to trick a user into opening a malicious HTML page in the vulnerable version of Chrome; thus the attack vector is likely web‑based. Once triggered, arbitrary code executes within the sandboxed renderer process, which could facilitate further exploitation.