The flaw stems from an inappropriate implementation in Google Chrome’s artificial‑intelligence component that existed in releases before version 150.0.7871.47. A remote attacker who has already compromised the renderer process can serve a specially crafted HTML page to the victim's browser. The malicious page may trigger the AI component to escape the browser’s sandbox, elevating the renderer process to a higher privilege level. If this happens the attacker could execute arbitrary code on the host system, compromising confidentiality, integrity, and availability of the machine.

All installations of Google Chrome that are older than 150.0.7871.47 on any supported operating system are affected. Users who have not upgraded remain at risk until the update is installed.

The CVSS score of 8.3 indicates a high severity. The EPSS score of less than 1 % suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a two‑step attack: first the renderer process must be subverted, then a malicious HTML page must be delivered to trigger the AI component flaw. Successful exploitation would lift the renderer process into a higher‑privilege context, enabling arbitrary code execution. The weakness is categorized as CWE‑693.