The heap buffer overflow lies in the Chromecast part of Google Chrome on Android, Linux, and ChromeOS for versions older than 148.0.7778.179. A local attacker who can send specially crafted network traffic to Chrome’s Chromecast interface can trigger the overflow, resulting in the execution of arbitrary code inside Chrome’s sandboxed process. The flaw is classified as CWE‑122 and is listed by Chromium as a Medium‑severity issue.

The affected product is Google Chrome running on Android, Linux, or ChromeOS before version 148.0.7778.179. Users on those platforms that have not upgraded are at risk.

The attack requires local access to the device and the ability to deliver malicious network traffic to the Chrome process. No publicly documented exploits exist, and the EPSS information is not available. The vulnerability is not included in CISA’s KEV catalog. The CVSS score of 7.5 indicates a high severity level. Because the breach occurs inside the Chrome sandbox, an attacker could potentially exploit the overflow to run code with the privileges granted to Chrome, making the risk moderate if a local attacker can reach the Chromecast interface.