The flaw is a heap buffer overflow (CWE‑122) in the ANGLE graphics layer of Google Chrome on Android prior to version 149.0.7827.53. A malicious HTML page processed by a compromised renderer process can trigger the overflow, allowing the attacker to escape the browser sandbox and potentially execute arbitrary code on the device.

All users running Google Chrome on Android with a version older than 149.0.7827.53 are affected. The issue is limited to the Chrome rendering engine and does not impact other Google products.

Chromium rates the vulnerability as high severity (CVSS 8.3). No EPSS score is available and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to first compromise the renderer process, which can happen via malicious web content. Once the renderer is compromised, the heap overflow can be leveraged to escape the sandbox, creating a significant risk of remote code execution.