A heap buffer overflow in the WebRTC component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox by loading a specially crafted HTML page. The flaw is a classic buffer overflow, identified by CWE‑122, that can compromise the confidentiality and integrity of data handled by the browser and may lead to further compromise if the attack surface extends beyond the sandbox.

Google Chrome users running any build prior to version 148.0.7778.179 are affected. The vulnerability is specific to the Chrome browser itself and does not directly impact the underlying operating system or other applications.

The vulnerability carries a high Chromium security severity rating and a CVSS score of 8.8; EPSS is not available. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to persuade a user to visit a malicious webpage or otherwise deliver a crafted page to the browser; the overflow occurs during normal processing of that page. Because the arbitrary code execution occurs within the sandbox, the risk of immediate system compromise is mitigated unless a separate sandbox escape is achieved. Nonetheless, the threat remains significant for users who download or view untrusted content.