The buffer overflow occurs in Chrome's WebGL implementation before version 151.0.7922.169. An attacker can trigger the overflow from a crafted HTML page, which permits execution of arbitrary code outside the browser sandbox. This is a classic out‑of‑bounds write (CWE‑122) that can lead to compromise of the host system.

This flaw affects Google Chrome on all platforms running version 151.0.7922.168 or older. The issue is limited to the stable channel, but any channel whose version is less than 151.0.7922.169 is vulnerable.

Chromium labels the issue with critical severity, and the exploit would operate remotely via a maliciously crafted web page. The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, but the combination of critical severity and remote execution path indicates a high risk of exploitation. An attacker only needs to lure a user to an infected web page; once the page loads in the victim’s Chrome, the overflow permits arbitrary code execution with the privileges of the browser process.