Out of bounds memory writes were discovered in the WebGL implementation in Google Chrome versions earlier than 154.0.8037.97. The flaw allows a malicious web page to corrupt memory outside the intended bounds, bypassing the browser’s sandbox and enabling an attacker to run arbitrary code with the privileges of the browser process. This is a classic out‑of‑bounds buffer overflow (CWE‑787) and was judged of critical severity by Chromium security reviewers.

Affected systems are all installations of Google Chrome that have not yet upgraded past version 154.0.8037.97. The vulnerability applies regardless of the operating system because the fault resides in the cross‑platform WebGL layer.

The attack is conducted remotely from a crafted HTML page, so any user who visits a malicious site or opens a malicious attachment could be exploited. No explicit EPSS score is currently published, but the critical severity and lack of a KEV listing suggest a high but not yet confirmed exploit likelihood. In practice, the exploit path requires a user to load a vulnerable page in a Chrome browser that has not been updated. The CVSS score of 9.6 confirms the critical severity of this flaw.