A heap buffer overflow in ANGLE within Chrome allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox by loading a specially crafted HTML page. The vulnerability is a classic heap buffer overflow involving an incorrect buffer length calculation (CWE-120) and an out-of-bounds write (CWE-122) that could lead to arbitrary code execution or privilege escalation within the renderer's context, jeopardizing the integrity and confidentiality of the user’s system.

This flaw exists in Google Chrome for desktop versions earlier than 148.0.7778.96. It affects any installation of Chrome on that platform where ANGLE is used for rendering graphics.

The CVSS score of 8.3 classifies the flaw as High severity, with an EPSS score of 0.00057 that indicates a very low probability of exploitation. It is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The exploit requires an attacker to first compromise the renderer process, meaning the attack vector is not a simple remote attack but a privilege escalation or sandbox escape path. Because of these prerequisites, the likelihood of exploitation in the wild is uncertain, yet the potential impact remains substantial should an attacker succeed.