A heap buffer overflow in the WebRTC component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox by loading a specially crafted HTML page. The flaw is a classic buffer overflow, identified by CWE‑120 and CWE‑122, that permits execution of arbitrary code within the browser sandbox.

Google Chrome users running any build prior to version 148.0.7778.179 are affected. The vulnerability is specific to the Chrome browser itself and does not directly impact the underlying operating system or other applications.

The vulnerability carries a high Chromium security severity rating and a CVSS score of 8.8; EPSS score of < 1% indicates a very low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to persuade a user to visit a malicious webpage or otherwise deliver a crafted page to the browser; the overflow occurs during normal processing of that page. Because the arbitrary code execution occurs within the sandbox, the risk of immediate system compromise is mitigated unless a separate sandbox escape is achieved. Nonetheless, the threat remains significant for users who download or view untrusted content.