Insufficient validation of untrusted input in the Linux Toolkit Theming component of Google Chrome allows an attacker who has already compromised the renderer process to escape the sandbox and execute arbitrary code with system privileges. This flaw is a CWE-20 input validation weakness and a CWE-807 resource path traversal vulnerability that can lead to full compromise of the affected machine if successfully exploited.

The vulnerability impacts Google Chrome users on Linux where the browser version is older than 150.0.7871.125. Any installation of Chrome on a Linux distribution that has not applied the latest update is susceptible.

The CVSS score of 8.3 classifies the flaw as high, but the EPSS score of less than 1% suggests that current exploitation attempts are rare or unlikely. The flaw is not listed in CISA’s KEV catalog, indicating no widespread use of publicly available exploits at this time. The likely attack vector is the delivery of a crafted HTML page that the compromised renderer processes, after which an attacker could gain privileges beyond the sandbox.