The vulnerability resides in ANGLE, the graphics abstraction layer used by Google Chrome on macOS. An insufficient validation of untrusted input allows a malicious user to embed crafted HTML that, when rendered by the affected browser, causes arbitrary code to execute within the renderer sandbox. The weakness is a classic input validation failure (CWE‑20). Attacker‑controlled code runs with the rights of the sandboxed process, exposing sensitive data or enabling further lateral movement. No evidence of a sandbox escape is provided, so the impact remains confined to the sandbox unless other vulnerabilities exist.

Google Chrome for macOS builds released before version 147.0.7727.55 are affected. Any user running an older version is at risk; installing version 147.0.7727.55 or later removes this issue.

Chromium assigns this flaw a medium severity score. Because no EPSS value is documented, the precise probability of exploitation is unknown. It is also not listed in the CISA KEV catalog, indicating that no known exploitation has been widely observed. The likely attack vector is a malicious webpage that a user visits or opens, as inferred from the mention of a crafted HTML page. Exploitation would require the user to allow the browser to render the malicious content; no additional privileges or user interaction are explicitly required.