A flaw in the ServiceWorker implementation of Google Chrome before version 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to craft an HTML page that can potentially escape the sandbox, giving the attacker elevated privileges. This can lead to access to restricted resources, data theft, or further system compromise. The vulnerability is classified as medium severity by Chromium’s security team and reflects improper authorization and privilege management weaknesses (CWE‑693) and additional weaknesses (CWE‑358).

Google Chrome browsers with versions prior to 148.0.7778.96 are affected, including all older stable releases. Affected users should verify that their installations are up to date or plan an upgrade.

The attack requires that the adversary already compromise the renderer process, which limits the likelihood of exploitation. Because EPSS is < 1% and the vulnerability is not listed in the CISA KEV catalog, the risk is considered moderate but still actionable. The CVSS score of 8.3 indicates high severity. Exploitation would proceed via a crafted HTML page that leverages the ServiceWorker sandbox bug, exploiting improper authorization (CWE‑693) and additional weaknesses (CWE‑358) to escape isolation boundaries.