An integer overflow is present in WebRTC networking code within Google Chrome. The overflow allows a specially crafted HTML page to cause an out‑of‑bounds memory write, potentially corrupting data stored in the browser’s heap. The flaw is a classic integer overflow (CWE‑190) compounded by a signed‑to‑unsigned conversion error (CWE‑472). This vulnerability can compromise the integrity of data handled by WebRTC but the CVE description does not confirm arbitrary code execution.

Google Chrome versions prior to 147.0.7727.55 on desktop operating systems—Windows, macOS, and Linux—are affected. Users running these builds on any platform that supports Chrome are at risk.

The base CVSS score of 8.8 reflects the high impact of the out‑of‑bounds write, yet the EPSS score is below 1 %, indicating very low current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. No publicly available exploits have been reported, so the risk relies on the potential for a crafted site exploiting the overflow; the likely attack vector is a remote attacker hosting a malicious web page that the user visits.