Buffer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This flaw stems from a bounds‑checking error that enables the attacker to overwrite memory addresses, a classic buffer overflow (CWE-119 and CWE-122). The exploit runs inside Chrome’s sandbox, giving the attacker an opportunity to escape and potentially gain higher‑level privileges on the host system.

Google Chrome versions prior to 156.0.8078.47 are impacted. Any installation of Chrome that has not been updated to 156.0.8078.47 or later is vulnerable.

The CVSS score of 8.8 indicates a high severity level. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector involves delivery of a malicious web page that a user visits, invoking the memory corruption and enabling the attacker to execute code within the sandbox. Once inside the sandbox, the attacker could attempt to escape or leverage other vulnerabilities for broader impact.