The flaw is a buffer overflow in ANGLE, a graphics abstraction layer used by Chrome on Android. An attacker who has already compromised the renderer process can feed a specially crafted HTML page to trigger an out‑of‑bounds write that bypasses the sandbox. This vulnerability can lead to arbitrary code execution in a process outside Chrome’s sandbox.

Google Chrome for Android versions earlier than 151.0.7922.169 are affected. Any device running these releases and that renders untrusted web pages is exposed to the risk.

Chromium rates the vulnerability as high and labels it a buffer overflow (CWE‑122). The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no confirmed exploitation at this time. The attack requires an initial compromise of the renderer process—potentially via a prior flaw or a malicious extension—after which arbitrary code can be executed with privileges beyond the sandbox. The risk remains significant for users that load suspicious web content on affected Chrome Android installations.