An integer overflow bug in Skia on Windows allows a remote attacker, who has already compromised the renderer process, to write data outside the bounds of a buffer. This out-of-bounds memory write can corrupt memory in the renderer process, potentially affecting the stability and integrity of the browser. The flaw is associated with both CWE-190 (Integer Overflow or Wraparound) and CWE-472 (Buffer Access with Weaker Check on Size).

Google Chrome for Windows versions earlier than 148.0.7778.168 are affected.

The vulnerability is marked as critical by Chromium, with a CVSS score of 7.5, indicating a high‑impact outcome if exploited. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker has already gained control of the renderer process, which limits the attack surface but still permits an out‑of‑bounds write that could compromise the process. The risk remains high for systems running the vulnerable versions.