A flaw in Google Chrome’s ANGLE component caused the browser to fail to validate certain input data properly. This defect permits an attacker who can craft a malicious HTML page to gain the ability to execute code outside the browser’s sandbox. The weakness is an input validation error, classified as CWE‑20, and the possibility of arbitrary code execution represents a severe breach of confidentiality, integrity, and availability for any system allowing the malicious content to be rendered.

The vulnerability affects users of Google Chrome versions prior to 153.0.8010.47 on any supported operating system. All installations of Chrome that have not yet been updated to 153.0.8010.47 or newer are potentially exploitable.

The CVSS base score of 9.6 indicates that exploitation would be highly damaging, exposing systems to full remote code execution. The EPSS score of less than 1% indicates that, as of the latest data, the probability of exploitation in the wild remains low, and the vulnerability is not listed in the CISA KEV catalog. The attack is likely to occur when the attacker lures a user to load a crafted HTML page, which is a typical social‑engineering vector.