The vulnerability is a heap buffer overflow in the GPU component of Google Chrome on Android. The flaw exists when a renderer process can be compromised, allowing an attacker to craft a malicious HTML page that triggers the overflow and potentially escapes the browser sandbox. If successful, the attacker could run arbitrary code with the permissions of the Chrome renderer, possibly gaining full device control. This is classified by Chromium as critical severity.

Affected systems are devices running Google Chrome on Android with versions prior to 149.0.7827.115. Chrome for Android before that release is vulnerable. No other platforms or products are listed.

The CVSS score is not provided, but the statement of critical severity indicates a high risk. The EPSS score is not available, and Chrome is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation yet. However, the attack vector requires an attacker to first compromise the renderer process, which can be done by serving malicious content over a network. Once inside the renderer, the overflow can be triggered through a crafted HTML page. This combination of conditions indicates a highly exploitable vulnerability for skilled adversaries, but the practical risk remains tied to the likelihood of the renderer being compromised.