A heap buffer overflow in the Color component of Google Chrome on ChromeOS, present in versions prior to 151.0.7922.72, allows an attacker who has compromised the renderer process to execute arbitrary code by loading a specially crafted HTML page. The flaw is a classic out‑of‑bounds write (CWE‑122) and is rated high severity by Chromium security, indicating a strong likelihood of a successful privilege escalation or complete compromise of the affected system.

The vulnerability affects Google Chrome running on ChromeOS devices. Any Chrome instance with a build older than 151.0.7922.72 is vulnerable, regardless of the user’s privilege level.

The CVSS score of 9.6 indicates a critical impact potential, while the EPSS score of less than 1% shows that large‑scale exploitation is currently unlikely but still possible. The flaw is not listed in the CISA KEV catalog, meaning a publicly documented exploit is not yet in circulation. The most likely attack path involves a remote attacker delivering a crafted HTML page that is rendered by the compromised renderer process, allowing the heap overflow and subsequent sandbox escape.