The vulnerability is an out-of-bounds read and write in the Dawn rendering engine of Google Chrome for Android that can allow a remote attacker to escape the browser sandbox, potentially leading to execution of arbitrary code with elevated privileges. It is rated critical by Chromium security and could be used to compromise the confidentiality, integrity, and availability of the device if an attacker supplies a crafted HTML page.

Affected are Chrome for Android versions prior to 148.0.7778.216. The issue applies to all devices running those Chrome builds, regardless of the underlying Android OS version. No other vendors or products are listed.

The EPSS score is <1%, indicating a very low but nonzero exploitation probability, although the exact likelihood of exploitation remains uncertain. The CVSS score is 8.3. It was not included in the CISA KEV catalog. The likely attack vector is a remote attacker sending a malicious HTML page that exploits the out-of-bounds memory access in Dawn to break out of the browser sandbox. No additional conditions are documented beyond the presence of the vulnerable Chrome version on Android.