The vulnerability originates from insufficient validation of untrusted input in the Dawn rendering engine used by Google Chrome on Linux and ChromeOS. An attacker who has already compromised the renderer process could serve a specially crafted HTML page that may allow the renderer to escape its sandbox, potentially leading to arbitrary code execution with elevated privileges. This reflects a failure to properly validate input (CWE‑20).

Google Chrome versions prior to 149.0.7827.103 on Linux and ChromeOS devices are affected. All newer releases contain the fix. No other platforms or products are listed as impacted.

The flaw is rated as a high‑severity issue by Chromium Security, but the exploitability depends on an initial compromise of the renderer process, which is a non‑trivial prerequisite. The CVSS score is 8.3. The EPSS score is not available and the vulnerability is not currently listed in CISA’s KEV catalog. In practice, an attacker would need to execute code in the renderer context, then supply a crafted HTML page to trigger the sandbox escape. The lack of available public exploits and the high severity suggest that the risk to users of unpatched Chrome versions is significant, especially in environments where the renderer process is exposed to untrusted content.