Google Chrome incorporates a WebML engine that processes HTML content. A heap buffer overflow exists in versions prior to 146.0.7680.71, permitting an attacker to corrupt heap memory when a crafted HTML page is rendered. The overflow can potentially lead to arbitrary code execution or other destructive actions, as indicated by the chromium security severity assessment. The weakness is a classic heap–based buffer overflow and out‑of‑bounds write, matching CWE‑122 and CWE‑787.

The flaw affects Google Chrome browsers for all major operating systems (Windows, macOS, Linux) and applies to any installation running a Chrome version older than 146.0.7680.71. Users of the Chrome stable channel before the March 2026 update are therefore at risk, while newer releases incorporate the patch.

The CVSS score of 8.8 marks this vulnerability as critical, though the EPSS score is listed as < 1%, implying a relatively low probability of widespread exploitation at present. The chromium security notes classify it as a remote attack that requires delivering a malicious HTML page to the victim’s browser; no privilege escalation is mentioned. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, reducing immediate threat perception but not eliminating the risk.