An integer overflow occurs in ANGLE, the graphics abstraction layer used by Google Chrome. The flaw allows a malicious web page to cause an integer arithmetic overflow that can be exploited to execute arbitrary code outside Chrome’s sandbox. This can result in code execution on the client machine and may lead to full system compromise. The Chromium project rates this as a medium severity issue, yet the nature of the flaw provides a clear remote‑code‑execution vector.

Google Chrome versions earlier than 156.0.8078.47 are affected. This includes all builds running ANGLE on Windows, macOS, Linux and Chrome OS. Users of any Chrome desktop channel (Stable, Beta, Dev, Canary) with a pre‑156.0.8078.47 release are potentially exposed.

The CVSS score of 8.8 indicates a high‑severity remote‑attack vector. The EPSS score of < 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, so no widespread exploitation reports exist. The attack requires a user to load a specially crafted HTML page, which can be delivered via phishing, social engineering, or compromised content. If such a page is opened, the integer overflow in ANGLE can be exploited to execute code outside Chrome’s sandbox, potentially allowing full system compromise.