An integer overflow flaw in the Chrome UI on Linux allows a remote attacker to craft a malicious HTML page that could cause the browser to escape its sandbox, effectively granting code execution outside the sandboxed environment. The vulnerability is classified as high severity by Chromium. The weakness is a classic case of input validation failure (CWE‑20).

Google Chrome running on Linux systems prior to version 149.0.7827.103 is affected. No other vendors or product variants are listed, and no specific sub‑versions are provided beyond the stated cutoff.

The attack requires a remote attacker to supply a specially crafted HTML document to a user’s Chrome instance. The exploit path is client‑side; the attacker does not need any network privileges beyond the normal ability to deliver a page. The EPSS score is not reported, and the vulnerability is not currently in the CISA KEV catalog, implying that no widespread, confirmed exploits are known at this time. Nevertheless, the CVSS score of 9.6 indicates high severity, and the potential for sandbox escape makes it plausible that an unpatched system could be compromised with malicious intent.