The vulnerability is a boundary‑check failure that lets a remote attacker who has already taken control of a renderer process load a crafted HTML page and escape the browser sandbox. Classified as CWE‑20, the flaw permits the attacker to cross the isolation boundary, and it is inferred that they may then use that escape to reach the host operating system and execute arbitrary code.

All installations of Google Chrome earlier than version 150.0.7871.47 on any operating system or device are potentially impacted. No other vendors or products are implicated by the CNA data.

The CVSS score of 9.6 indicates a very high risk if the conditions are met, but the EPSS score of less than 1% and the absence from the CISA KEV catalog suggest that active exploitation is currently unlikely. Successful exploitation requires a pre‑existing compromise of a renderer process followed by delivery of a malicious HTML payload. It is inferred that, once the sandbox is breached, the attacker could further compromise the host OS or elevate privileges.