This vulnerability is a heap buffer overflow in the WebML component of Google Chrome that can be triggered by a crafted HTML page. A remote attacker could exploit the overflow to execute arbitrary code inside the browser’s sandbox, severely compromising process isolation. The weakness is classified as both CWE-122 (Heap-Based Buffer Overflow) and CWE-787 (Out-of-bounds Write).

All installations of Google Chrome with a version prior to 148.0.7778.168 are affected. These versions were released before the May 2026 security update that addressed the flaw.

The flaw provides a remote code execution path that is accessed over the network via a malicious web page. The CVSS score is 8.8, indicating high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog; despite this, the CVE is marked Critical and the impact is immediate. Given the nature of the vulnerability, any system that inadvertently loads the malicious page faces a high likelihood of exploitation if the browser is not patched.