A buffer overflow bug in the WebRTC subsystem of Google Chrome allows a malicious web page to trigger an out‑of‑bounds write, leading to arbitrary code execution within the sandboxed context of the browser. The weakness is classified as CWE-787, an Out‑of‑Bounds Write. The impact is that a remote attacker can execute code with the privileges of the Chrome process, potentially gaining control over the user’s system or data that the browser can access.

Google Chrome versions prior to 148.0.7778.96 are affected. The vulnerability is present in all platforms supported by Chrome that include the WebRTC component.

The exploit requires the victim to visit a crafted web page that takes advantage of the WebRTC stack; the attack vector is therefore remote via the network. The CVSS score of 8.8 indicates a High severity impact, while Chromium labels this vulnerability as Medium severity, suggesting that while exploitation is possible it may not grant full system compromise. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The lack of an EPSS score and KEV designation indicates a moderate probability of exploitation, but the threat remains significant due to the potential for arbitrary code execution.