A heap buffer overflow exists in the ANGLE component of Google Chrome on Windows, allowing a remote attacker who has been able to compromise the renderer process to create a crafted HTML page that could trigger the overflow. The vulnerability is classified as CWE‑120 and CWE‑122, both indicating vulnerable heap buffer behaviors, and could lead to a sandbox escape and arbitrary code execution within the Chrome environment.

The flaw affects Google Chrome users on Windows running any version prior to 148.0.7778.216. Attackers would need to inject malicious content into a renderer process, typically through a web page that the user views.

The CVSS score is 8.2 and the EPSS score is less than 1%, indicating a high severity but a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted HTML page delivered over HTTP or HTTPS to a user browsing the web. Once the renderer is compromised, the unchecked Heap access could break the sandbox boundaries, enabling execution of arbitrary code. The overall risk is considered high, given the potential for remote code execution, but the exact probability remains uncertain due to the low EPSS score.