The flaw arises from an insufficiently guarded permission check inside Chrome’s DevTools. A remote adversary who has already succeeded in compromising a renderer process can use a specially crafted HTML page to escape the sandbox bounds. Once outside the renderer sandbox, the attacker gains privileges comparable to or higher than the browser process, potentially allowing arbitrary code execution or privileged actions within the user’s environment. This failure of security controls is mapped to CWE‑693.

Google Chrome desktop versions earlier than 150.0.7871.47 are affected. The vulnerability is independent of operating system; any supported OS running a desktop build before this revision is susceptible. No server‑side or mobile product is listed.

The CVSS score of 9.6 indicates critical severity, yet the EPSS score of <1% reflects a very low chance that this flaw will be actively exploited in the wild. The issue is not cited in the CISA KEV catalog, so presently there is no evidence of a publicly known exploit. Exploitation requires a two‑step process: first, the attacker must compromise the renderer process via some other vector such as a separate vulnerability or malicious content; second, the attacker must deliver the malicious HTML that triggers the DevTools escape. Because the initial renderer compromise is outside the scope of this vulnerability, the overall likelihood remains low but non‑zero.