A buffer overflow flaw exists in the WebGL implementation of Google Chrome for Android releases before 154.0.8037.57. An attacker can construct a malicious HTML page that, when loaded in the browser, exploits the overflow to run code outside the browser sandbox. This critical vulnerability carries a CVSS score of 9.6 and is classified as CWE-122. The result is that the attacker can gain full control of the device, compromising confidentiality, integrity, and availability of the system, its data, and any services running on the device.

The issue affects Google Chrome for Android versions earlier than 154.0.8037.57. The vulnerability is specific to those builds and does not impact other Chrome platforms or vendors listed by the CNA.

The CVSS score of 9.6 indicates a high severity, and the EPSS score is unavailable, which suggests no publicly known widespread exploitation, although the vulnerability is critical. The CVE is not currently listed in CISA’s KEV catalog, but the nature of the flaw—remote code execution through a crafted web page—means the attack vector requires a user to load malicious content. An attacker could potentially use phishing or compromised sites to lure Android users into visiting the exploit page, thereby executing arbitrary code on the device.