The flaw lies in the data validation performed by the InterestGroups component of Google Chrome. Because the browser accepts insufficiently sanitized input, a renderer process that has already been compromised can use a crafted HTML page or web content to escape the process sandbox. The result is a privilege‑escalation scenario where the attacker can execute code with higher privileges and compromise the integrity of the host system.

The vulnerability affects versions of Chrome older than 148.0.7778.96. No specific operating‑system version list is provided beyond the Chrome product, but the flaw is present across all platforms where Chrome runs, as indicated by the manufacturer‑agnostic CPE entries.

With a CVSS score of 8.3 and an EPSS of < 1%, the risk of exploitation remains moderate but non‑negligible. The vulnerability is not recorded in CISA’s KEV catalog, suggesting no known active exploitation. However, an attacker requires an initial renderer compromise, typically achieved through malicious web content, after which the sandbox escape can be performed. The high severity and potential for system compromise make this flaw a priority for remediation.