Technical impact
A race condition in the DevTools module of Google Chrome allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox by serving a specially crafted HTML page. The flaw can give the attacker elevated privileges, enabling execution of arbitrary code on the host system. The vulnerability stems from improper input validation (CWE‑20) and a race condition (CWE‑368) and is considered high severity.
Affected Systems
Google Chrome versions prior to 149.0.7827.197 are affected. The issue affects all desktop builds of the stable channel. No other vendors or products are listed.
Risk and Exploitability
The flaw can be exploited once an attacker has gained a foothold in the renderer process, which is often achieved through other exploit chains or social engineering. The EPSS score of 0.00184 indicates a very low probability of exploitation. The vulnerability is not currently listed in CISA KEV. The CVSS score of 8.3 indicates a high severity, but without proof of widespread exploitation the exact likelihood remains uncertain.
Debian DLA
Debian DSA