The vulnerability arises from insufficient validation of untrusted input within ANGLE, a graphics abstraction layer in Google Chrome. The flaw allows a remote attacker who already has access to the renderer process—such as through a compromised web page—to potentially escape the renderer sandbox. This could give the attacker privileges beyond the browser’s limited sandbox, enabling them to execute arbitrary code or manipulate system resources. The weaknesses are identified as CWE-20 (Improper Input Validation) and CWE-1286.

Google Chrome web browsers prior to version 148.0.7778.216 are affected. The issue has been reported for all platforms that ship Chrome in the stable channel before this release, it is inferred that Windows, macOS and Linux are affected. Versions 148.0.7778.216 and later contain the patch that restores proper input validation in ANGLE.

The EPSS score is < 1% and the CVSS score of 8.3 reflects a high severity level. The Chromium team has labeled the issue as high severity, and the vulnerability is not listed by CISA in its KEV catalog. Because exploitation requires the attacker to already control the renderer process, the risk is contingent on initial compromise of a web page. Nonetheless, if an attacker can deliver a crafted HTML page that triggers the flaw, they could gain elevated privileges on the host. This risk is amplified for users who frequently visit untrusted sites or download potentially malicious content.