The Tint component of Google Chrome has an inappropriate implementation that permits a remote attacker to craft an HTML page to perform a sandbox escape. This flaw can potentially allow the attacker to break out of the renderer sandbox and execute code with higher privileges than normally granted to the browser process. The vulnerability is ranked as high severity by Chromium and is mapped to CWE-501, indicating improper handling of security boundaries.

All installations of Google Chrome older than version 148.0.7778.216 are affected. No finer sub‑version detail is supplied, so any build preceding that revision should be considered vulnerable until a patch is applied.

The CVSS score is 9.6, indicating extremely high damage potential if exploited. The EPSS score of less than 1% suggests that at this time the probability of exploitation is low; however, the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, mediated through a web browser, where the attacker must get the victim to open a specially crafted HTML page—such as through a malicious website, phishing email, or embedded document. Successful exploitation would result in sandbox escape, potentially giving the attacker full control of the host system.