Insufficient policy enforcement in Mojo, the inter‑process communication framework of Google Chrome, can be exploited by a remote attacker who has already compromised the renderer process. The attacker may use this flaw to escape the browser sandbox and gain higher‑privilege access to the operating system, an example of a privilege escalation vulnerability.

Google Chrome desktop versions prior to 150.0.7871.47 are affected.

The CVSS score of 9.6 suggests a high severity, yet the advisory rates the vulnerability as low severity. The EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an initial compromise of the renderer process—typically via another vulnerability or malicious content. Once inside the renderer, an attacker could use the flaw to escape the browser sandbox and elevate privileges on the underlying operating system.