The vulnerability is an out‑of‑bounds write in the WebAudio engine of Google Chrome that exists in all releases prior to version 148.0.7778.168. A maliciously crafted HTML page can trigger the overflow, allowing a remote attacker to execute arbitrary code inside the browser’s sandbox. This flaw provides a pathway for code execution and, if the sandbox is bypassed, could lead to privilege escalation within the system.

The affected product is Google Chrome. All releases before Chrome 148.0.7778.168 are impacted. Users must verify that they are running Chrome 148.0.7778.168 or newer before the fix is deployed.

The vulnerability carries a high severity rating from Chromium. No EPSS score is currently available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit this issue remotely by serving a malicious web page to a user, exploiting the out‑of‑bounds write from the browser’s context. Because the attack vector is web‑based, any user who visits the crafted page is at risk, and there is no requirement for local privileges or user interaction beyond normal browsing. The CVSS score is 8.8, indicating a high severity level.