An object lifecycle flaw inside PowerVR on Google Chrome for Android allows an attacker to craft a malicious HTML page that triggers heap corruption, potentially enabling arbitrary code execution. The vulnerability is categorized as critical by Chromium, indicating a high likelihood of compromising the confidentiality, integrity, and availability of the affected system. It is a direct flaw that can alter application memory and does not rely on additional software exploits.

Google Chrome on Android versions prior to 145.0.7632.159 are impacted. The issue exists in the PowerVR component which is used across Android Chrome builds; other platforms such as macOS, Linux, and Windows are listed in the CPE data but the flaw is specific to the Android implementation.

The CVSS score of 8.8 reflects the severity of the flaw, while the EPSS score of less than 1% indicates a low, but nonzero, probability of real‑world exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers can exploit it by directing a user to a crafted HTML page, suggesting that the attack vector is remote over the network. Exploitation would require the victim to open the malicious content. Once triggered, the heap corruption could lead to arbitrary code execution with the privileges of the Chrome process.