Technical impact
The vulnerability stems from an insecure implementation within Google Chrome’s isolated web application framework. A malicious file can trigger code execution inside a sandboxed environment, providing the attacker with the rights of that sandbox. This enables the attacker to run arbitrary code, potentially accessing or modifying files, data, or services that the sandboxed app is allowed to interact with. The impact is the compromise of confidentiality, integrity, or availability of the affected system, depending on the capabilities granted to the sandbox.
Affected Systems
All users of Google Chrome older than version 149.0.7827.53 are affected, regardless of operating system. The weakness exists in the isolated web apps feature offered by Chrome.
Risk and Exploitability
The CVE was assigned a medium security severity by Chromium. Its CVSS score is 8.8, the EPSS score is <1%, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, leveraging a malicious file that could be delivered through a website or a file download. While no widespread exploitation has been reported, the ability to execute code in an ostensibly sandboxed context presents a significant risk to users who enable or interact with isolated web apps. This weakness is categorized as CWE-434, indicating an uncontrolled file type handling vulnerability.
Debian DSA