Inappropriate implementation in the Views component of Google Chrome on Linux can allow a remote attacker who has already shown control over the renderer process to potentially escape that sandbox by serving a specially crafted HTML page. This escape would give the attacker the same privileges that the renderer runs with on the victim's machine. Chromium labels this flaw as high severity.

All Chrome installations on Linux running a version prior to 149.0.7827.103 are affected. The vulnerability resides in the renderer, which processes content from HTML before rendering.

The CVSS score is 8.3 and EPSS is not available, indicating a high severity assessment by Chromium. The flaw is not listed in CISA’s KEV catalog. Exploitation requires delivery of crafted HTML to a compromised renderer; the attacker must already have bypassed initial sandboxing. Consequently, while the vulnerability’s exploitability is non‑trivial, the conditions for successful exploitation are constrained.