An out-of-bounds write occurs in the GPU subsystem of Google Chrome while running on Android. The flaw allows an attacker who has compromised the renderer process to execute arbitrary code outside Chrome’s sandbox by loading a crafted HTML page, according to the Chromium security severity advisory. The vulnerability is a classic out‑of‑bounds write flaw (CWE‑787) that can lead to full system compromise if the compromised code runs successfully.

The issue affects users of the Chrome browser on Android devices using any build that precedes Chrome version 154.0.8037.57. All users running these earlier Android builds are potentially vulnerable, regardless of the operating system version or device manufacturer. Updates released after 154.0.8037.57 contain the fix and remove the flaw from the GPU path.

The CVSS score of 8.3 indicates a high severity impact, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, but the advisory labels it as critical and notes that a crafted HTML page can be used to trigger code execution. The attack requires the attacker to already have compromised the renderer process, which typically implies a prior exploit or compromised content that the renderer loads. Once this prerequisite is met, an attacker can use the out-of-bounds write to escape the Chrome sandbox and execute arbitrary code on the device. Because the flaw is in GPU code, the attack surface is limited to web content that triggers GPU rendering; however, the potential damage is complete compromise of the device.