A memory corruption flaw in Chrome’s WebAudio subsystem allows a remote attacker to trigger arbitrary code execution inside the browser sandbox by loading a specially crafted HTML page. The vulnerability arises from improper bounds checking on audio data, classified as a prototype-based buffer overflow (CWE‑119). Since the attack occurs from within the browser process, it can be used to escape the sandbox and achieve higher system privileges through subsequent exploitation steps.

The flaw affects all installations of Google Chrome older than version 156.0.8078.73. Any user who visits a malicious site while running one of these affected browsers could be targeted, regardless of operating system, because the vulnerability resides in the browser code shared across platforms.

The problem is designated High severity by Chromium, indicating significant impact. The EPSS score is not available, and it is not currently listed in CISA’s KEV catalog. Attack vectors require the victim to open a malicious webpage – a common scenario for social engineering. As exploitation would require only a crafted HTML page, the practical risk is elevated in environments where users frequently visit untrusted sites.