A flaw in the Glic component of Google Chrome allows a remote attacker to escape the browser sandbox because the component insufficiently validates untrusted HTML input (CWE‑20). When exploited, this vulnerability could elevate the attacker’s privileges beyond the sandbox, enabling the execution of arbitrary code on the host system and threatening confidentiality, integrity, and availability.

Google Chrome installations on any desktop operating system that are running a version older than 150.0.7871.47 are affected; the vulnerability applies to all desktop environments where a vulnerable Chrome instance is used.

The CVSS score of 8.8 signals a high‑severity flaw, meaning substantial impact if the weakness is triggered. The EPSS score of less than 1% suggests that exploitation attempts are rare. The vulnerability is not cataloged in CISA KEV. The likely attack vector is a remote attacker delivering a crafted HTML page or file that the browser processes, which may allow the attacker to escape the sandbox.