Insufficient policy enforcement in the Chrome sandbox on Linux allows a remote attacker to reach a state in which code may execute with the privileges of the browser process by serving a crafted HTML page. The CVE description indicates a potential sandbox escape, but does not explicitly state what assets may be accessed or what actions can be performed once the sandbox is bypassed. Therefore the known impact is the loss of sandbox containment, with the actual consequences remaining undefined by the available data.

Google Chrome running on Linux systems with stable‑channel builds earlier than version 149.0.7827.53 is affected. All Linux distributions that use the standard Chrome release channel before this update are vulnerable.

The vulnerability is marked as low severity by Chromium, and no EPSS metric is available. It is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. The likely attack vector involves a remote attacker hosting a malicious HTML page that a victim must load, such as through phishing or social engineering. Because the analysis does not provide evidence of any direct exploitation code, the risk is considered low pending patch deployment.