The vulnerability is an out‑of‑bounds write in the font rendering engine of Google Chrome. A malicious HTML page can trigger the flaw to cause the browser to overwrite memory while parsing fonts, potentially allowing an attacker to run arbitrary code inside the sandbox. The issue is classified as CWE‑787 and was given a high severity rating by Chromium.

The flaw exists in all Google Chrome desktop builds released before version 148.0.7778.168. Users running any earlier stable channel build are susceptible, regardless of operating system. The problem is limited to Chrome and does not affect other browser vendors.

A remote attacker can exercise the vulnerability by serving a crafted HTML page that the victim visits. No additional privileges or user interaction beyond loading the page are required. The CVSS score of 8.8 indicates high severity; the EPSS score of 0.00038 indicates a very low but non‑zero probability of exploitation, and the flaw is not yet in the CISA KEV catalog, but the attack vector is clearly remote.