An integer overflow occurs in the GPU subsystem of Google Chrome for Android, allowing a remote attacker to trigger out‑of‑bounds memory access when the victim loads a specially crafted HTML page. The vulnerability is classified with medium severity by the Chromium security team, indicating that exploitation is not trivial but not impossible.

Google Chrome for Android versions earlier than 149.0.7827.53 are affected. All newer Chrome releases and other Google Chrome products are not impacted.

The flaw can be exposed remotely through a web page, meaning any device with an Internet browser running the vulnerable Chrome version is at risk. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the medium severity rating and the potential for out‑of‑bounds memory access suggest a measurable risk. Attackers would likely need to entice the victim to visit or load the malicious page, and further exploitation would depend on additional conditions that are not described in the CVE data.