In Google Chrome versions prior to 149.0.7827.53, an inappropriate implementation within the Dawn graphics engine lets a malicious actor who has already compromised the renderer process run arbitrary code inside the browser’s sandboxed environment. The flaw allows exploitation through a specially crafted HTML page, giving attackers the ability to execute code with the renderer’s privileges.

Vendors affected are Google Chrome. Any client running Chrome below version 149.0.7827.53 is vulnerable. Versions 149.0.7827.53 and later include the fix.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so the current exploitation probability is unknown. The attack vector requires an initial compromise of the renderer, after which a crafted HTML page can trigger the flaw. Given a CVSS score of 8.8, the risk is high for users who may visit untrusted web content. No publicly known active exploits are documented at this time.