This flaw stems from insufficient validation of untrusted input in the WebML engine of Google Chrome. A crafted HTML page can trigger an out‑of‑bounds memory write, which may allow a remote attacker to execute arbitrary code on the victim’s machine. The weakness is related to improper bounds checks and unsafe memory handling, as reflected in the CWE identifiers for input validation failure and buffer overflow.

The vulnerability affects Google Chrome versions earlier than 147.0.7727.55 across all major operating systems—including Windows, macOS, and Linux—as indicated by the corresponding CPE entries. Users of these browser versions are at risk when visiting malicious or compromised web content.

The CVSS score of 8.1 denotes a high severity, while the EPSS score below 1 % suggests that the exploitation probability is currently low. The issue is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack vector is a web page loaded in the victim’s browser; the attacker must host a malicious site that serves specially crafted content that triggers the out‑of‑bounds write. The impact could be complete system compromise if the memory corruption is successfully exploited.