A single integer overflow in the ANGLE component of Google Chrome on Windows allows a remote attacker, through a specially crafted HTML page, to perform an out‑of‑bounds memory write. The flaw is an integer wraparound (CWE‑190) combined with a signedness conversion error (CWE‑472), which can compromise data integrity and potentially enable arbitrary code execution if the attacker can influence execution flow. The Chromium severity is rated medium, but the potential impact is non‑trivial.

Google Chrome – Windows users running any release prior to 148.0.7778.168 are vulnerable. The issue was fixed in the 148.0.7778.168 update and later versions, so any installation that has not been updated is at risk.

The vulnerability can be exploited remotely by serving a malicious HTML page to the target. The CVSS score of 4.3 indicates medium severity. Based on the description, it is inferred that an attacker might achieve arbitrary code execution through the out‑of‑bounds write. The lack of an EPSS score indicates an uncertain probability of exploitation, and the issue is not listed in CISA’s KEV catalog. The likely attack vector involves a user viewing an untrusted web page that triggers the out‑of‑bounds memory write when ANGLE processes the content.