Integer overflow in the editing component of Google Chrome, present in versions prior to 156.0.8078.79, allows a crafted HTML page to exploit a wrap‑around bug. The flaw originates from an unchecked arithmetic operation (CWE‑190) and can lead to execution of arbitrary code within the browser sandbox. While the attacker is limited to sandboxed execution, the impact is equivalent to an injection of malicious code that can compromise the user’s system if the sandbox is bypassed or further privileges are gained.

All users running Google Chrome versions earlier than 156.0.8078.79 are affected.

The vulnerability is rated high by Chromium’s security severity. No public EPSS score is available and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is delivery of a malicious HTML page from a remote website or compromised content that is loaded in the browser. Because the flaw allows arbitrary code execution inside the sandbox, it poses a significant threat to users who browse untrusted web content.