A buffer overflow in the ANGLE component of Google Chrome on Android allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The flaw corresponds to CWE‑122 and is classified by Chromium as Critical, with a CVSS score of 9.6 indicating a severe impact if exploited.

The affected product is Google Chrome for Android. Versions older than 155.0.8059.79 are vulnerable; all releases from that version onward incorporate the fix. The vulnerability is not tied to a specific device model but exists at the browser code level.

The EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog, indicating a low current probability of exploitation, yet the CVSS score of 9.6 still reflects a high potential impact. The likely attack vector requires a remote attacker to host or deliver a malicious HTML page that a user opens in Chrome; the flaw allows escape from the sandbox and execution of arbitrary code. No publicly available exploitation code is documented in this CVE record, so security teams should treat the potential threat with caution and prioritize patching while monitoring for new exploit discoveries.