This flaw is an out‑of‑bounds write in the V8 JavaScript engine that lets a remote attacker, after compromising the renderer process, execute arbitrary code inside Chrome’s sandbox. The vulnerability does not allow direct escape from the sandbox, but code execution within it can lead to privilege escalation or further compromise of the host system. The weakness is a classic memory corruption issue (CWE‑787).

Google Chrome versions prior to 149.0.7827.53 are affected. The public release of this fixed version appears in the June 2026 stable channel update. Enterprises running earlier builds must patch before the update is rolled out.

The CVSS score of 8.8 indicates a high severity, with the exploitation requiring only a crafted HTML page and successful compromise of the renderer process. The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers with access to a vulnerable browser instance can trigger the exploit remotely. Given the high CVSS and the accessibility of an exploit via a crafted web page, the risk is moderate to high for organizations that grant web access to untrusted content.