An insufficiency in validating untrusted input in the Chromoting component of Google Chrome on Linux allows a remote attacker who has already compromised a renderer process to craft a malicious Chrome Extension that can potentially escape the sandbox. The weakness, identified as CWE‑20, could let an attacker gain code execution privileges beyond the browser sandbox, jeopardizing system confidentiality and integrity.

Google Chrome on Linux systems running any version prior to 149.0.7827.53 is affected. The issue is limited to the desktop (stable channel) releases of Chrome on Linux platforms.

The CVE was assigned a medium Chromium security severity and no EPSS data is available. It is not listed in the CISA KEV catalog. Exploitation requires prior renderer process compromise and the inclusion of a crafted extension, indicating a medium level of difficulty and limited attack surface. If a renderer is already breached, an attacker could escape the sandbox and execute arbitrary code.