In versions of Google Chrome older than 154.0.8037.57 in the browser’s rendering engine can be triggered via UI interaction. The flaw permits a local attacker to execute arbitrary code that escapes the normal process sandbox, effectively bypassing the browser’s security boundaries. According to the Chromium security severity metric, this issue is rated high and falls under CWE‑416.

The vulnerability impacts Google Chrome for desktop platforms. Any installation of Chrome with a version number lower than 154.0.8037.57 is potentially vulnerable until a patch is applied. The vendor has issued a stable channel update containing the fix, as listed in the Chrome release notes.

The CVSS score of 7.8 classifies this as a high‑severity flaw. Because the EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, the exploitation probability is not quantifiable today, but local exploitation remains feasible. A local attacker would need to interact with Chrome’s UI, for example by visiting a maliciously crafted page or a manipulated web form, to trigger the achieve code execution. Given the high impact—execution outside the sandbox—organizations should prioritize applying the patch.