A stack buffer overflow in the Skia graphics library within Google Chrome can be triggered by a specially crafted HTML page, allowing a remote attacker to corrupt the browser’s stack and potentially execute arbitrary code. The vulnerability is a classic stack overflow (CWE‑121) that elevates a local input problem to a remote attack surface.

Google Chrome versions earlier than 149.0.7827.53 are affected. Users of any Chrome installation that has not yet updated to a recent release must address the issue immediately.

The vulnerability is listed with the Chromium security severity of Medium; no EPSS score is available, and it is not included in the CISA KEV catalog. Attackers would need to prompt users to visit a malicious web page or embed the payload in a link that activates the vulnerability. Because it is a remote code execution flaw with unmitigated input, the potential impact is high if exploited, while exploitation likelihood remains uncertain without further publicly available exploit code.