A heap buffer overflow exists in the ANGLE component of Google Chrome. Exploitation requires an attacker to first compromise the renderer process, likely through an earlier vulnerability or social engineering, although this was not explicitly stated. Once the renderer is compromised, a specially crafted HTML page can trigger the overflow and allow the attacker to escape the browser sandbox, potentially executing arbitrary code with system privileges. The weaknesses are identified as heap‑based buffer overflows (CWE-122) and buffer overflow boundary violations (CWE-787).

Google Chrome versions prior to 148.0.7778.216 are affected. Users running any earlier stable channel are at risk until they upgrade to the patched version or later.

The CVSS score is 9.0, confirming a high severity. The EPSS score is <1%, indicating a very low but non-zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to first compromise the renderer process, which may be achieved via prior exploitation or social engineering. Once compromised, a crafted HTML page can trigger the overflow and allow sandbox escape, potentially permitting execution of arbitrary code with system privileges.