The vulnerability is an integer overflow in the QUIC protocol implementation within Google Chrome prior to version 151.0.7922.72. It enables a remote attacker who has already compromised the renderer process to potentially escape the renderer sandbox through a crafted HTML page, which falls under CWE‑190. Successful exploitation would allow the attacker to execute arbitrary code on the host, compromising all aspects of security including confidentiality, integrity, and availability.

The flaw affects all desktop builds of Google Chrome that run versions earlier than 151.0.7922.72. Google released a patch in the stable channel update 151.0.7922.72, which eliminates the integer overflow and the associated sandbox escape.

The CVSS base score of 9.6 classifies this flaw as critical, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog. An attacker would need to deliver a malicious HTML document to a user, leverage an already compromised renderer process, and then trigger the integer overflow to escape the sandbox. Once outside the sandbox, full control of the Chrome process and potentially the underlying system can be achieved, making remediation essential.