A buffer overflow flaw exists in ANGLE, the graphics engine component of Google Chrome. The vulnerability enables an out‑of‑bounds write, which can corrupt heap data structures. This heap corruption can be leveraged by a remote attacker to achieve arbitrary code execution on the victim machine. The weakness is identified by CWE‑787.

All installations of Google Chrome earlier than version 149.0.7827.53 are vulnerable. This includes the stable channel releases for Windows, macOS, Linux and other supported operating systems.

Because the flaw can be triggered by a specially crafted HTML page served to a user, the attack vector is a malicious web site or content delivered via email or other web traffic. No publicly available exploits have been reported, and the EPSS score is not available. The Chrome advisory rates the vulnerability as high severity, with a CVSS score of 8.8. Although the risk cannot be quantified precisely, the absence from the CISA KEV catalog and the high severity suggest a moderate to high risk that warrants prompt mitigation.