An integer overflow occurs in the codec handling code of Google Chrome. The bug allows a remote attacker to craft an HTML page that triggers an overflow, resulting in arbitrary memory read and write operations. The consequence is that attackers could read sensitive data, overwrite critical data structures, or execute malicious code within the browser process. The weakness aligns with CWE-190 (Integer Overflow) and CWE-472 (Uncontrolled Format String).

Google Chrome versions earlier than 146.0.7680.178 on all major operating systems—Windows, macOS, and Linux—are affected. The issue applies to all platform variants served by the Chrome browser, as the underlying codec code is shared across OSes.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves a malicious HTML page served over the web; a victim must visit the page for the overflow to occur. Given the high potential impact and the availability of a browser update, the risk is significant enough to warrant prompt patching.