A heap buffer overflow exists in the ANGLE component of Google Chrome, affecting all releases prior to 148.0.7778.216. A malicious actor can deliver a specially crafted HTML page that triggers the overflow, enabling the attacker to corrupt heap memory, which could lead to arbitrary code execution or denial of service. The weakness is mapped to CWE-122 and CWE-131, classic buffer over-read/buffer overflow and integer overflow issues that directly impact integrity by allowing unauthorized memory modification.

The vulnerability is present in Google Chrome. All builds before version 148.0.7778.216 are affected; users must check whether their browser falls within this range to determine exposure.

Chromium has labeled the issue as High severity and the CVSS score is 8.8. The EPSS score is less than 1%, indicating a very low exploitation probability. Nonetheless, the attack vector is remote via a crafted HTML page, making the threat level significant for any user who views untrusted content. The vulnerability is not listed in the CISA KEV catalog, but its high severity suggests that organizations could benefit from rapidly applying the fix.