Technical impact
The vulnerability is a type confusion flaw in the ANGLE graphics layer of Google Chrome. Prior to version 152.0.7977.65, an attacker could supply a specially crafted HTML page that triggers the type confusion, potentially executing arbitrary code outside the browser sandbox. This flaw is classified as CWE‑843, representing incorrect type conversion or cast, and the primary impact is remote code execution.
Affected Systems
Google Chrome browsers running any version before 152.0.7977.65 are affected. The patch is delivered in Chrome 152.0.7977.65, so users running older releases should update.
Risk and Exploitability
The reported CVSS score is 8.8, indicating a high severity. The vulnerability is not currently listed in the CISA KEV catalog. The EPSS score is < 1%, suggesting a low exploitation probability. Based on the description, the likely attack vector is a malicious web page; an attacker would need the user to open or render a crafted HTML document. If the exploit is successfully triggered, code could run outside the sandbox, and the attacker would gain the privileges of the browser process.
Debian DLA
Debian DSA