The flaw is in Chrome’s WebAssembly engine prior to version 145.0.7632.159. An attacker who can supply a crafted HTML page can trigger an out‑of‑bounds memory access inside the browser, corrupting local memory. Such corruption can potentially be leveraged to execute arbitrary code, exfiltrate data, or crash the browser. The vulnerability is classified under CWE‑284, indicating a weakness involving improper authorization or access control.

This issue affects Google Chrome installations on all major operating systems—Windows, macOS, and Linux—as reflected in the associated CPE strings. Any user running Chrome versions earlier than 145.0.7632.159 is potentially exposed. The vulnerability does not depend on the underlying operating system version beyond the presence of Chrome.

The CVSS score of 8.8 marks this as a high‑severity flaw, yet the EPSS score is below 1 %, indicating a low probability of current exploitation. It is not currently listed in CISA’s KEV catalog. The likely attack vector requires a victim to visit a malicious or compromised webpage that hosts the exploit. No privileged escalation is required; the attack impacts the user’s browser session directly.