An out‑of‑bounds write flaw in Chrome’s Tint component, present in all builds prior to 150.0.7871.46, can be triggered by a specially crafted HTML page. Owing to the vulnerability (CWE‑787), a remote attacker could potentially escape the browser sandbox and execute code with the privileges of the browser process. The CVE description notes that the escape is "potentially" achievable, meaning the exploitation outcome depends on successfully triggering the out‑of‑bounds write.

All desktop instances of Google Chrome older than 150.0.7871.46, across Windows, macOS, and Linux, are susceptible to the flaw and must install the patched revision before processing untrusted HTML content.

Chromium rates the issue with a CVSS score of 9.6, indicating very high severity. The EPSS score of <1% suggests that real‑world exploitation is unlikely but not impossible. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is remote: an attacker must persuade the victim’s browser to parse a malicious HTML document, typically via a link or embedded content. Successful exploitation would yield sandbox escape and the ability to run code at the browser process level.