The flaw is a heap buffer overflow (CWE–120 and CWE–122) in the ANGLE graphics layer of Google Chrome on Android prior to version 149.0.7827.53. A malicious HTML page processed by a compromised renderer process can trigger the overflow, allowing the attacker to escape the browser sandbox. Based on the description, it is inferred that the escape could enable execution of arbitrary code on the device.

All users running Google Chrome on Android with a version older than 149.0.7827.53 are affected. The issue is limited to the Chrome rendering engine and does not impact other Google products.

Chromium rates the vulnerability as high severity (CVSS 8.3). The EPSS score of <1% indicates a low probability of exploitation, and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to first compromise the renderer process, which can happen via malicious web content. Once the renderer is compromised, the heap overflow can be leveraged to escape the sandbox, potentially leading to remote code execution – this outcome is inferred from the provided details.