Buffer overflow in the ANGLE component of Google Chrome for Android allows a malicious attacker to execute arbitrary code outside the normal sandbox by loading a specially crafted HTML page. According to the description, the flaw is in ANGLE, with CWE‑122 indicating a heap‐based buffer overflow. The vulnerability can compromise the confidentiality, integrity, and availability of the device.

The affected products are Google Chrome running on Android operating systems before version 154.0.8037.57. All installations of Chrome prior to this revision are susceptible. No additional product variations are noted.

Based on the description, it is inferred that a malicious website can trigger a heap-based buffer overflow in Chrome's ANGLE component by delivering a specially crafted HTML page to the browser on Android. This overflow enables the attacker to execute arbitrary code outside the sandbox with the privileges of the current user session. The CVSS score of 9.6 indicates a critical impact, while the EPSS score of <1% suggests a low probability of exploitation. Nevertheless, because any remote web page can be used to launch the attack, the threat remains significant, as attackers could host or embed malicious content on a site or send it via email.