The WebRTC component in Google Chrome contains a heap buffer overflow that can be triggered by a maliciously crafted HTML page served from a remote host. If exploited, an attacker could corrupt the browser’s process memory and potentially execute arbitrary code, leading to compromise of the host system. This flaw is a classic example of unchecked user‑controlled data causing memory corruption, classified as CWE‑122 and CWE‑787.

The vulnerability affects users running Google Chrome version 147.0.7727.137 or earlier on any platform where the browser is installed. Since the flaw resides in the WebRTC subsystem, it is active whenever the browser parses a page that includes WebRTC elements.

The CVSS base score of 8.8 indicates a high severity, while the EPSS score of less than 1% shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to host a crafted HTML page and entice an end‑user to load it, typically via phishing or a malicious URL. In the absence of a publicly known exploit, the risk remains high until an official patch is applied.