The vulnerability is a buffer overflow in Chrome’s Workers implementation, allowing a crafted HTML page to corrupt memory and potentially execute arbitrary code. As a result, a remote attacker could gain code execution privileges within the browser’s sandbox, potentially leading to privilege elevation or further exploitation of the host system if sandbox escapes are achievable.

All Google Chrome users running a version prior to 155.0.8059.84 are affected. The flaw exists in the Workers component of the Chrome browser shipped with older stable channel releases. Users on earlier releases without the security update are at risk.

The CVSS score of 8.8 classifies this as a serious vulnerability, and while the EPSS score is unreported, the lack of a KEV listing does not diminish the potential for exploitation via a malicious web page. Attackers would need to lure a user to a designed HTML page to trigger the overflow. Once triggered, the attacker could run code confined to the browser sandbox, with the possibility of escaping to the host if additional weaknesses exist. Because the flaw can be exploited by anyone who can view a crafted page, it presents a broad attack surface.