A buffer overflow occurs within the Animation component of Google Chrome, allowing a remote attacker to execute arbitrary code inside the sandbox by delivering a specially crafted HTML page. The flaw can be triggered locally by a malicious web page, leading to execution of code with the same privileges as the browser process. The stated severity in Chromium is High, reflected in a CVSS score of 8.8, indicating a significant potential impact on confidentiality, integrity, and availability if an attacker succeeds.

The vulnerability affects all versions of Google Chrome prior to 155.0.8059.79. Any deployment of Chrome running a version earlier than 155.0.8059.79 is susceptible to the exploit. The affected product is Google:Chrome as listed by the CNA.

The EPSS score is below 1 %, indicating a very low but non‑zero likelihood of exploitation today. The vulnerability is not published in CISA’s KEV catalog, which suggests that no high‑profile exploits have yet been observed. Attacks would most likely originate from a malicious or compromised webpage that an unsuspecting user visits, with the attacker needing only the ability to render HTML to trigger the overflow. The risk level remains high due to the potential for remote code execution, but the current exploitation probability is low.