A buffer overflow in the ANGLE graphics component of Google Chrome on Android allowed a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. This flaw is a classic memory corruption issue (CWE-122), enabling the attacker to gain full control of the device’s operating system, which can lead to data theft, persistence, or further attacks. The vulnerability is assigned a critical severity rating by Chromium's security team.

Google Chrome for Android versions up to 154.0.8037.56 (any release prior to 154.0.8037.57) is susceptible. Devices running these versions, regardless of other security controls, are at risk; any user who visits a malicious or manipulated web page in that browser may trigger the vulnerability.

The exploit is remotely triggered through a malicious or spoofed HTML page, making the attack vector user‑driven. The CVSS score of 9.6 indicates critical severity, and the flaw permits code execution outside the sandbox, which is a high‑impact condition. The EPSS score is not available, but the absence of KEV inclusion does not negate the threat given the nature of the vulnerability.