An integer overflow in the internationalization subsystem of Google Chrome on Windows, present in versions earlier than 148.0.7778.168, allows an attacker to trigger an out‑of‑bounds write by serving a specially crafted HTML document. This vulnerability is a classic example of CWE‑190: Integer Overflow or Wraparound and CWE‑472: Struct Mismanagement, where improperly sized data structures lead to memory corruption. If successfully exploited, the out‑of‑bounds write could result in arbitrary code execution or a denial‑of‑service condition in the browser process.

Google Chrome running on Windows, any version earlier than 148.0.7778.168. Those releases are affected by the integer overflow in the internationalization component.

The CVSS score is 4.3, indicating low severity. The attack vector is remote; it requires a malicious HTML page delivered to a victim’s Chrome browser on Windows. Because the flaw leads to memory corruption, a successful exploit could result in a browser crash or potentially allow arbitrary code execution. No KEV listing or EPSS score is available, but the lack of these metrics does not diminish the risk. Until the browser is updated, users remain potentially vulnerable to exploitation.