The vulnerability is a heap buffer overflow in the Skia graphics library used by Google Chrome. A remote attacker who has compromised the renderer process can supply crafted HTML content that triggers the overflow, allowing the attacker to escape the browser's sandbox. This can lead to arbitrary code execution on the user’s system as the attacker can gain higher privileges than the sandbox permits. The flaw is identified as CWE‑122, a classic out-of-bounds write, and CWE‑787, a buffered memory overflow that can corrupt adjacent data.

Google Chrome versions earlier than 147.0.7727.138 on all supported operating systems are affected. Users of the Stable channel running any of these revisions could be vulnerable if the renderer process is compromised.

The CVSS score is 8.3, indicating a high severity, and the EPSS score of < 1% indicates a very low exploitation probability, but the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be attacker‑controlled HTML delivered to the renderer, so an adversary with the ability to serve malicious content to a user could potentially exploit it. Exploitation requires either a separate flaw that compromises the renderer or a direct delivery of a malicious HTML page. Given the high impact and the limited exploitation probability, the risk remains significant.