A type confusion vulnerability in Chrome Tabs allows a remote attacker who has already compromised the renderer process to specify a crafted HTML page that may lead to a sandbox escape. The flaw enables the attacker to break out of the renderer process’s security boundaries, potentially acquiring higher privileges on the affected system. The Chromium security severity is noted as High due to the elevated privilege level that can be achieved.

All desktop installations of Google Chrome prior to version 150.0.7871.47 are vulnerable. The issue is present regardless of operating system or platform. Users of earlier Chrome releases on Windows, macOS, or Linux are at risk if they run unpatched versions.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the defined severity by Chromium is High. Exploitation requires the attacker to have already gained control of the renderer process, a condition that can arise from malicious web content or compromised host processes. While the attack vector is not fully remote in the traditional sense, a third‑party web page could be used to bootstrap the renderer process compromise, making the vulnerability a significant risk for systems that allow untrusted content to load arbitrarily. The lack of an EPSS score indicates limited publicly known exploitation, yet the high severity and potential for privilege escalation warrant prompt attention.