The vulnerability is a heap buffer overflow within the Chromium WebAudio engine. A remote attacker can send a specially crafted HTML page to a user running an affected version of Google Chrome, triggering code execution inside the browser’s sandbox. This flaw is classified as a buffer overflow, mapping to CWE‑120 and CWE‑122. The compromised sandbox can lead an attacker to achieve arbitrary code execution with the privileges of the browser context, potentially escalating privileges or exfiltrating data if further sandbox escape is possible.

The affected product is Google Chrome for all major desktop platforms. Versions prior to 146.0.7680.153 are vulnerable. This includes installations on Windows, macOS, and Linux, as identified by the CPE entries. Users running any of these older releases need to upgrade to a patched build.

The severity rating is CVSS 8.8, indicating high impact. The EPSS probability is less than 1%, suggesting limited known exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to load a malicious webpage in Chrome; the attack vector is remote through a crafted HTML page. No special prerequisites beyond browsing the attacker‑controlled site are required.