An integer overflow in the font rendering component of Google Chrome allows a maliciously crafted HTML page to trigger an out‑of‑bounds memory write. This corrupts the browser process memory and may enable an attacker to alter program flow or execute code within the Chrome process scope. The weakness is grouped under CFA‑190 and CFA‑472, indicating improper signed arithmetic and unchecked index usage.

The flaw affects Google Chrome versions earlier than 146.0.7680.165 across all supported operating systems, including Windows, macOS, and Linux. Users who run an affected Chrome build and load a page controlled by an attacker are at risk. The vulnerability applies to all Chrome deployments as listed in the CPE strings for Google Chrome.

The CVSS score of 8.8 places this vulnerability in the high‑severity range. The EPSS score of less than 1% suggests that, as of now, the probability of exploitation is low, and it is not listed in the CISA KEV catalog. The likely attack vector is remote, network‑based via a malicious web page. An attacker needs only to entice a victim to open the crafted page; no local privileges are required. The potential outcome is the execution of arbitrary code in the Chrome process.