A buffer overflow occurs in the Google Chrome for Android older than version 154.0.8037.92. The flaw permits a remote attacker to construct a malicious HTML page that, when rendered by Chrome, can cause memory corruption and allow arbitrary code execution outside the browser sandbox. This vulnerability is rated as critical within Chromium’s own severity classification.

Android users running Google Chrome versions earlier than 154.0.8037.92 are affected. The stable channel reference is inferred. The issue is limited to the ANGLE implementation within the browser and does not extend to other Google products (inferred).

The CVSS score of 9.6 signals a very high severity. The EPSS score of < 1% indicates a very low probability of exploitation, but the flaw is publicly known and could be abused by attackers who cause users to open a crafted webpage. The vulnerability is not yet listed in CISA’s KEV catalog, but its high severity and remote nature suggest immediate attention. An attacker would send or host a malicious HTML page that, when visited by a user on an affected device, triggers the overflow and executes code with the same privileges as the browser process.