The flaw stems from inadequate policy enforcement in Google Chrome’s DevTools, allowing data received over the network to be processed in a way that can lift sandbox restrictions. A remote attacker delivering crafted network traffic to a vulnerable Chrome client could use this weakness to escape the browser sandbox, potentially leading to arbitrary code execution or further system compromise. The description labels the issue as a low‑severity Chromium vulnerability, yet the consequences of a successful sandbox escape are significant, affecting confidentiality, integrity, and availability of the host system.

Google Chrome installations running any version prior to 148.0.7778.96 are vulnerable. The issue is specific to Windows, macOS, and Linux desktop clients that expose DevTools to network input. All affected users who have not updated Chrome to at least 148.0.7778.96 remain at risk.

The Common Vulnerability Scoring System (CVSS) score is 8.1, indicating a high severity, and the Exploit Prediction Scoring System (EPSS) value is unavailable in the current data. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. With a high severity rating and no known widespread exploitation, the likelihood of exploitation appears modest. Nonetheless, the criticality of a sandbox escape warrants attention, as the attack surface is remote and does not require privileged local access.