An integer overflow occurs in the WebGL engine of Google Chrome on Android versions prior to 151.0.7922.72. The flaw allows a remote attacker to craft a malicious HTML page that triggers the overflow, potentially escaping Chrome’s sandbox. If successful, the attacker gains code execution privileges on the device, able to read, modify, or delete local data.

Google Chrome browsers on Android, any build prior to version 151.0.7922.72.

The flaw is exploitable via a crafted HTML page that can be delivered over any network connection. The EPSS score is lower than 1%, indicating that current exploit activity is limited. The vulnerability is not listed in CISA’s KEV catalog. Despite the low exploitation probability, the high CVSS score of 9.6 and the potential for sandbox escape warrant urgent attention. The attack path requires no additional credentials beyond the ability to load a malicious web page.