An integer overflow occurs when Chrome parses XML files on Windows before version 148.0.7778.216. The vulnerability is limited to scenarios where a remote attacker has already compromised the renderer process. Exploitation can allow the attacker to escape the renderer sandbox, potentially escalating privileges and compromising the host system. The flaw is classified as CWE‑190 and CWE‑472 and is listed as having high severity by Chromium security.

Google Chrome running on Windows platforms is affected. The vulnerability applies to all releases of Chrome before 148.0.7778.216, regardless of minor patch level. Users of older or out‑of‑support Windows versions using these Chrome releases are also at risk.

The CVSS score is 8.3, but the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a crafted HTML page delivered to a compromised renderer process, which suggests that the attacker already has some presence. Even without large‑scale exploitation campaigns, the potential for privilege escalation makes the risk significant, especially in environments where Chrome operates with elevated privileges.