A flaw in the ServiceWorker implementation of Google Chrome before version 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to craft an HTML page that can potentially escape the sandbox, giving the attacker elevated privileges. This can lead to access to restricted resources, data theft, or further system compromise. The vulnerability is classified as medium severity by Chromium’s security team and reflects improper authorization and privilege management weaknesses (CWE‑693).

Google Chrome browsers with versions prior to 148.0.7778.96 are affected, including all older stable releases. Affected users should verify that their installations are up to date or plan an upgrade.

The attack requires that the adversary already compromise the renderer process, which is a prerequisite that limits the likelihood of exploitation. Because EPSS is unavailable and the vulnerability is not listed in the CISA KEV catalog, the risk is considered moderate but still actionable. The CVSS score is 8.3, indicating high severity. Exploitation would proceed via a crafted HTML page that leverages the bug in the ServiceWorker sandbox to escape isolation boundaries.