A heap buffer overflow exists in the ANGLE graphics layer of Google Chrome versions prior to 148.0.7778.216. The flaw allows a remote attacker who has succeeded in compromising the renderer process to trigger a buffer overflow, which may lead to a sandbox escape and execution of arbitrary code on the host system. The vulnerability is carried out by crafted HTML content, indicating that the attack requires delivery of malicious web content to the vulnerable browser instance.

The affected product is Google Chrome. All releases prior to 148.0.7778.216 are vulnerable. The primary entry point is the ANGLE component used for rendering web pages. Specific hardware or platform does not alter the attack surface as the flaw resides in Chrome's rendering engine.

The CVSS score of 8.3 indicates a high severity due to its remote impact and potential for full code execution. The EPSS score is <1%, indicating a very low probability of exploitation. The vulnerability has not been catalogued in CISA KEV yet, suggesting no widespread exploitation reports to date. Attackers would need to lure a user into visiting a malicious site that triggers the overflow in the renderer process. Once a sandbox escape is achieved, the attacker can potentially compromise the entire system. The lack of early public disclosure means effective mitigation can be achieved by deploying the vendor’s patch soon after release.