This vulnerability is a heap buffer overflow in the ANGLE graphics component of Google Chrome on macOS. An attacker can send a specially crafted HTML page that causes the overflow, allowing arbitrary code to run inside the browser's sandbox. The weakness is classified as a heap-based buffer overflow, which can compromise application confidentiality and integrity. The official severity is high, indicating that successful exploitation would enable a remote attacker to execute code with the sandbox's privileges.

Users running Google Chrome on macOS before version 147.0.7727.55 are affected. The issue exists in all builds of the stable Chrome channel on macOS that include the vulnerable ANGLE implementation. No other platforms or Chrome versions are listed as impacted.

The CVSS base score of 8.8 reflects significant impact with remote exploitation. The EPSS score of less than 1% indicates the probability of exploitation is currently low, and it is not listed in CISA's KEV catalog. Nevertheless, the attack vector is remote via a crafted HTML page delivered over the network, meaning that any user who visits a malicious website could be targeted. The sandbox limitation reduces damage scope, but arbitrary code execution is still possible within the sandbox context and could lead to privilege escalation or further compromise.