An inappropriate implementation in the Headless feature of Google Chrome allows a remote attacker who has already compromised the renderer process to escape the sandbox by processing a specially crafted HTML page. This flaw can be exploited to obtain privileges beyond the sandbox, potentially enabling the attacker to access restricted system resources. The vulnerability is classified as high severity by Chromium’s own security team.

Google Chrome versions prior to 149.0.7827.115 are affected. No further version details are supplied or listed by the CNA.

The CVSS score of 9.6 indicates a high severity rating. The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires a remote attacker to first compromise the renderer process, which may be feasible through a malicious web page delivered to a user running Chrome in Headless mode. Once the attacker has control of the renderer, the crafted HTML can trigger the sandbox escape. The low EPSS score suggests that exploitation is unlikely to be widespread, but if the conditions are met the impact is substantial.