This vulnerability is a heap buffer overflow in the Color component of Google Chrome on ChromeOS. It affects Chrome versions before 151.0.7922.72. An attacker who has compromised the renderer process can exploit this flaw via a specially crafted HTML page to perform a sandbox escape, potentially gaining higher privileges or executing arbitrary code outside the sandbox. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to sandbox escape from the renderer process, allowing an attacker to execute code with higher privileges on the affected ChromeOS device. This compromises the security boundaries intended to isolate web content, potentially leading to full system compromise.

A fixed version is available: Chrome 151.0.7922.72. Users and administrators should update Chrome on ChromeOS to version 151.0.7922.72 or later to remediate this vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html provides official update information.