Google Chrome’s Tint rendering engine implements an inappropriate bounds check that can be triggered by a specially crafted HTML page. The flaw allows out-of-bounds memory access (CWE‑119, CWE‑131), which may enable an attacker to read or overwrite arbitrary memory on the client’s machine. The Chromium security team has rated this issue as high severity, indicating the potential for significant impact if the memory corruption is leveraged.

This vulnerability is present in Google Chrome on all platforms where the Tint engine is used, affecting all versions prior to 147.0.7727.138. Administrators should ensure their Chrome installation is updated to at least 147.0.7727.138 or later to mitigate the defect.

Exploitability requires delivery of a crafted web page, making it a classic drive‑by attack scenario. The CVSS score of 8.1 reflects a high‑severity risk. The EPSS score of < 1% indicates that while exploitation is possible, the probability of real‑world attacks is low, and the vulnerability is currently not in CISA’s KEV catalog. If an attacker can exploit the out-of-bounds access, it could lead to remote code execution or other severe compromises.