This vulnerability originates from insufficient validation of untrusted input in Chrome’s WebML module. A crafted HTML page can trigger an out‑of‑bounds memory write, allowing a remote attacker to corrupt memory. While Chromium classifies the severity as low, an attacker who succeeds in corrupting memory could potentially achieve arbitrary code execution, compromising confidentiality, integrity, or availability of the victim’s system.

Google Chrome browsers with a version prior to 147.0.7727.55 are affected. No other vendors or products are listed.

The vulnerability is exploitable remotely through a malicious web page that the user must open. No EPSS score is available and the issue is not listed in the CISA KEV catalog, implying a low public exploitation probability. Nonetheless, because it can lead to code execution, it remains a risk for any user who visits or opens the malicious content.