The vulnerability is an integer overflow in the WebML component of Google Chrome, allowing a crafted HTML page to overflow a buffer and corrupt heap memory. This flaw is mapped to CWE-190, an integer overflow, and CWE-472, an unsynchronized access to shared resources. When triggered, the attacker could potentially hijack program flow, leading to remote code execution or data disclosure (inferred).

The issue affects Google Chrome versions prior to 146.0.7680.71 on all major operating systems, including Windows, macOS, and Linux, as the browser’s WebML implementation is cross‑platform.

With a CVSS score of 8.8 and an EPSS below 1 %, the exploit is considered high severity but low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and the attack vector is remote, requiring the victim to load a malicious webpage that contains the crafted content (inferred).