This vulnerability is caused by an inappropriate implementation in the Chromoting component of Google Chrome on Linux. A malicious user who can send crafted network traffic to a Chrome instance may cause the browser to execute code with elevated privileges. As a result, the attacker can gain operating‑system level access, potentially enabling full control of the affected machine. The weakness is reflected in the CWE identifiers for improper authorization and insecure communication handling.

Google Chrome on Linux systems running versions prior to 151.0.7922.72 is affected. The issue specifically targets the Chromoting feature, which is used to support remote desktop functionality.

The CVSS score of 8.4 qualifies the vulnerability as high severity. The EPSS score of less than 1% indicates a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a local attacker using malicious network traffic to interact with the Chromoting service. Exploitation requires that the Chrome instance be running on the victim machine with the vulnerable version, and no additional user interaction is required beyond initiating the traffic. The impact is an elevation of privileges to full OS control.