Insufficient validation of untrusted input in the Accessibility module of Google Chrome for macOS allows a remote attacker who has already compromised the renderer process to potentially escape the renderer sandbox and execute code at the system level. The weakness is a classic input validation flaw (CWE‑20), and because it enables a sandbox escape, it carries the high risk of compromising the entire host environment. The attacker can construct a malicious HTML page that, when processed by the vulnerable renderer, triggers the escape path, enabling arbitrary code execution.

Google Chrome on macOS running a version prior to 149.0.7827.115 is impacted. All users with an older stable channel build are potentially vulnerable if they encounter a crafted HTML page within a compromised renderer.

The vulnerability is classified as Critical, indicating a very high severity. EPSS data is not available, so the precise likelihood of exploitation cannot be quantified, but the absence of a KEV listing suggests it has not yet been widely observed in the wild. The likely attack vector is a remote attacker who has succeeded in compromising the renderer process; once that initial foothold is achieved, crafted HTML can trigger the sandbox escape attempt. Organizations should treat this as a high‑risk issue requiring immediate remediation.