The vulnerability is a heap buffer overflow in the GPU component of Google Chrome. A crafted HTML page can trigger a memory corruption that allows a remote attacker to execute arbitrary code, potentially taking full control of the affected system. The weakness is identified as CWE‑120 and CWE‑122, reflecting buffer copy without size checking and heap buffer overflow respectively. Chrome categorized the issue as high severity because it can compromise confidentiality, integrity, and availability on the victim host.

The flaw affects Google Chrome versions prior to 146.0.7680.178 on all supported operating systems—Windows, macOS, and Linux—since the vulnerability resides in a cross‑platform GPU subsystem. Users running a vulnerable build of Chrome on any of these platforms are at risk.

The CVSS score of 8.8 indicates a high potential impact, while the EPSS score of less than 1 % reflects a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation. Attackers would need to lure users to a malicious web page containing carefully crafted content; the attack is remote, network‑based, and does not require prior user interaction beyond browsing the page. The combination of high severity, low exploitation probability, and broad platform coverage places the overall risk at a moderate to high level for organizations that rely on Chrome for web access.