An inappropriate handling of Views in Google Chrome for Linux versions earlier than 149.0.7827.103 allows a remote attacker who has already gained control over the renderer process to escape the browser sandbox by serving a specially crafted HTML page. The escape would give the attacker the same privileges that the renderer runs with, potentially compromising the entire system. Chromium labels this flaw as high severity.

All Linux installations of Google Chrome older than version 149.0.7827.103 are affected. The vulnerability resides in the renderer component, which processes content from HTML before rendering.

The CVSS score is 8.3 and the EPSS score is reported as less than 1%, indicating a very low but non‑zero exploitation probability. The flaw is not listed in CISA’s KEV catalog. Exploitation requires that the attacker first compromise the renderer process; once that initial barrier is bypassed, delivery of crafted HTML enables the sandbox escape. Consequently, while the vulnerability’s impact is severe, the overall exploitation likelihood remains constrained by the prerequisite compromise.