A heap buffer overflow exists in the ANGLE graphics stack of Google Chrome on macOS. The flaw can be triggered by a specially crafted HTML page, allowing an attacker to run arbitrary code inside the browser’s sandboxed environment. This vulnerability corresponds to a classic buffer overflow (CWE‑122) and has a high severity rating according to Chromium’s internal assessment.

The impact is confined to users of Google Chrome on macOS versions preceding 147.0.7727.55. Earlier builds of the stable channel are vulnerable; the issue is not present in newer releases that incorporate the fix.

Because the flaw can be triggered by loading a malicious web page, the potential attack vector is remote and does not require local user interaction beyond visiting the site. The CVSS score is not supplied, but the high severity checklist and lack of mitigation steps in the public advisory suggest a serious risk. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, so it is unknown whether active exploitation is occurring.