The vulnerability is a buffer overflow in the GPU component of Google Chrome for Android. A maliciously crafted HTML page can trigger a memory corruption that allows an attacker to execute code outside Chrome’s sandbox, providing the capability to run arbitrary instructions on the affected device, which compromises confidentiality, integrity, and availability of the system.

Google Chrome on Android versions prior to 157.0.8103.38 are affected. The flaw resides in the GPU subsystem and impacts all devices running otherwise unpatched Chrome versions on Android.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The CVE’s description indicates a high severity level, implying that exploitation could occur if a user visits a malicious web page containing the malformed HTML. The attack is inferred to require user interaction to load the crafted page, after which the GPU over‑run can be triggered and arbitrary code executed outside the browser sandbox. Because no patch or workaround is presently published, the risk remains significant for all Android devices running Chrome earlier than 157.0.8103.38.