A buffer overflow exists in the ANGLE graphics component of Google Chrome on Windows. The flaw is triggered by an unchecked buffer write (CWE‑122 and CWE‑20), allowing a crafted HTML page to cause arbitrary code execution outside the browser sandbox with the same privileges as the Chrome process. An attacker can embed malicious content into a website or deliver it via a targeted link to a victim.

Google Chrome versions earlier than 156.0.8078.47 running on Windows operating systems are affected. The vulnerability is not present in the 156.0.8078.47 release or later releases. End‑users and administrators must ensure that any Chrome installation is updated to at least this version.

The CVSS score of 8.8 indicates a high severity. The EPSS score is below 1 % indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no widespread documented exploitation has occurred. The likely attack vector is remote: an attacker delivers a malicious HTML page to a victim who opens it, thereby triggering the overflow. Successful exploitation would grant the attacker code execution with Chrome process privileges, elevating to any system privileges available to that user.