The vulnerability is an integer overflow (CWE-472) in the way Chrome processes font data. An attacker can craft a malicious HTML page that causes Chrome to execute arbitrary code while still inside the browser sandbox. The flaw carries a medium severity label from Chromium, but because it leads to remote code execution, the overall impact is substantial for the affected user.

Google Chrome browsers running any desktop operating system with a version older than 148.0.7778.168. The issue applies to all product releases that use the affected font handling code.

The exploit requires the victim to open a specially crafted HTML page, which can be delivered through a web site, email, or other remote content. The CVSS score of 8.8 indicates high severity, and the EPSS score of <1% indicates a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw permits remote code execution within a sandbox, the risk remains high if an attacker manages to trigger it, especially in environments where Chrome is widely deployed and not kept up to date.