A heap buffer overflow occurs within the GPU component of Google Chrome on Android, which can be triggered by a crafted HTML page. The flaw allows an attacker who has already gained control of the renderer process to potentially escape the sandbox, giving them the ability to run code outside the confined environment. This high‑severity issue can lead to the execution of arbitrary code with elevated privileges.

Google Chrome for Android is affected; versions prior to 149.0.7827.103 are vulnerable.

The vulnerability carries a CVSS score of 8.3, indicating a high severity. Exploitation requires the attacker to first compromise the renderer process and then exploit the heap overflow via a crafted page. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Once a sandbox escape is achieved, attackers can perform further malicious actions on the device.