A weakness in Google Chrome's GPU policy enforcement allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox by loading a specially crafted HTML page. The vulnerability can elevate the attacker's privileges from a restricted renderer context to higher levels on the host, enabling execution of arbitrary code, data exfiltration, or persistence. Chromium labels the issue as low severity, yet the ability to bypass sandbox boundaries represents a classic privilege escalation scenario.

Google Chrome, versions earlier than 150.0.7871.47. Users of the stable channel on any platform that uses Chrome's renderer and GPU components are affected.

Exploit likelihood is limited by the requirement that the attacker must first gain a foothold in the renderer process, a step that usually necessitates another vulnerability or social engineering. No EPSS score is currently available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. However, if a renderer compromise occurs, a maliciously crafted web page could trigger the GPU policy flaw and allow a local sandbox escape, resulting in higher level privileges on the host machine.