An integer overflow occurs in ANGLE, the graphics abstraction layer used by Google Chrome on Windows. When Chrome parses a maliciously crafted HTML page, the overflow can corrupt heap objects, potentially allowing an attacker to alter program control flow and achieve arbitrary code execution if exploitation succeeds. The flaw is caused by unchecked arithmetic operations (CWE-190) and improper buffer handling (CWE-472).

Google Chrome versions for Windows released before 146.0.7680.153 contain the vulnerability. The issue is limited to builds that include ANGLE and is not present in newer releases that have applied the integer‑overflow fix. End‑users on Windows who have earlier Chrome versions need to upgrade.

The CVSS base score of 8.8 marks the flaw as high severity. However, an EPSS score of less than 1% suggests that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a victim to visit a specially crafted HTML page or otherwise render content that triggers the integer overflow, a client‑side attack that does not rely on remote network access beyond normal browsing.