Technical impact
The vulnerability is an integer overflow in the Blink rendering engine. A crafted HTML page can trigger the overflow, allowing a remote attacker to execute arbitrary code inside Chrome’s sandbox. The flaw is identified as both CWE‑190 and CWE‑472, which describe integer overflow leading to unexpected behavior and wraparound risks. The impact is the ability to subvert the sandbox protection and run code with the privileges of the browser process, potentially compromising user data and system integrity.
Affected Systems
Affected systems are users of Google Chrome prior to version 149.0.7827.53, including any release channel that has not yet received the update. Only Chrome on that version baseline is impacted; newer releases contain the fix.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity. The EPSS score is < 1%, suggesting a very low but nonzero exploitation probability. The CVE is not listed in the CISA KEV catalog, meaning no confirmed widespread exploitation. The likely attack vector is a remote attacker delivering a malicious HTML payload, such as hosting the page on a website or sending via email, which when rendered in Chrome triggers the overflow. Because the vulnerability can be triggered via a standard web page, normal browsing activities could lead to exploitation without additional user action, making it a significant threat to any system running the affected Chrome version.
Debian DSA