An out‑of‑bounds write flaw in ANGLE in Google Chrome versions prior to 156.0.8078.47 allows a remote attacker who has compromised the renderer process to trigger a crafted HTML page that can write beyond array bounds and potentially execute arbitrary code outside the sandbox. The vulnerability is classified as CWE‑284 (Improper Access Control) and CWE‑787 (Out‑of‑Bounds Write), which can enable an attacker to escape the browser sandbox and elevate privileges.

Google Chrome builds prior to version 156.0.8078.47 are affected; any stable channel release before that point is vulnerable.

The CVSS score of 8.8 highlights a high severity. The EPSS score is less than 1%, and the issue is not listed in the CISA KEV catalog, indicating a low quantified exploitation probability. The likely attack vector is a remote attacker delivering a malicious web page that triggers the out‑of‑bounds write, potentially allowing code to execute beyond the sandbox boundaries.