An integer overflow in the Skia graphics engine of Google Chrome allows a remote attacker to execute arbitrary code while the browser process remains sandboxed. The flaw, classified as CWE‑472, is triggered by a specially crafted HTML page served to a user’s browser. Because the malicious payload runs inside the sandbox, an attacker could gain control of the browser process, potentially allowing data exfiltration or manipulation of the user session.

All users running a Chrome stable channel version earlier than 147.0.7727.55 are affected. The vulnerability is present in every build before that revision, regardless of operating system. Updating to any Chrome release equal to or newer than 147.0.7727.55 removes the flaw.

Chromium has labeled the issue as high severity. A remote attacker can trigger the overflow by loading a malicious web page, and the vulnerability has not been listed in CISA’s Known Exploited Vulnerabilities catalog. EPSS information is not available, but the combination of a high severity rating and the ability to launch the attack over the Internet indicates a significant risk for unpatched users.