An integer overflow occurs in the ANGLE component of Google Chrome, allowing a remote attacker who has already compromised the renderer process to perform an out‑of‑bounds memory write via a specially crafted HTML page. The flaw can lead to arbitrary code execution in the context of the browser, giving the attacker the ability to execute malicious instructions with the privileges of the rendering process. The static analysis and vendor assessment categorize the vulnerability with high severity.

The problem exists on Google Chrome running on Windows prior to version 146.0.7680.178. Users who have not upgraded to that or newer release are exposed. The vulnerability is specific to the Windows build of Chrome, as the relevant ANGLE implementation is used exclusively on that platform in this context.

The CVSS score of 7.5 indicates a high impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation today. The flaw requires that the attacker first gain control of the renderer process, most commonly by delivering malicious web content that the victim’s browser will interpret. Once the renderer has been compromised, the out‑of‑bounds memory write can be leveraged to execute arbitrary code. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.