The vulnerability is a heap buffer overflow in the Skia graphics library used by Google Chrome. A remote attacker who has compromised the renderer process can supply crafted HTML content that triggers the overflow, allowing the attacker to escape the browser's sandbox. This can lead to arbitrary code execution on the user’s system as the attacker can gain higher privileges than the sandbox permits. The flaw is identified as CWE‑122, a classic out‑of‑bounds write that can corrupt memory and alter program control flow.

Google Chrome versions earlier than 147.0.7727.138 on all supported operating systems are affected. Users of the Stable channel running any of these revisions could be vulnerable if the renderer process is compromised.

The CVSS severity is High, but no EPSS score is currently available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be attacker‑controlled HTML delivered to the renderer, so an adversary with the ability to serve malicious content to a user could potentially exploit it. Exploitation requires either a separate flaw that compromises the renderer or a direct delivery of a malicious HTML page. Given the high impact and the lack of exploitation mitigations in the renderer, the risk remains significant.