The vulnerability is an integer overflow in the Skia graphics library used by Google Chrome. Prior to version 148.0.7778.216, a maliciously crafted HTML page can trigger the overflow once the attacker has gained code execution inside the renderer process. The flaw falls under CWE-472 and can lead to a sandbox escape, allowing the attacker to execute code with elevated privileges or compromise the host system. The description notes a Chromium security severity of High.

Google Chrome browsers running versions older than 148.0.7778.216 on any supported platform (Windows, macOS, Linux) are affected. Any system that has a user who may open or load HTML content from untrusted sources and uses the stable channel before the identified update is at risk.

The CVSS score is 8.3 and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote delivery of a crafted HTML page that is rendered by the Chrome renderer process. The flaw requires that an attacker already compromise the renderer, which could occur via a separate XSS or memory corruption exploit. If the sandbox escape succeeds, the attacker can execute code with the privileges granted to the renderer, potentially bypassing browser isolation. Given the high severity rating by Chromium and the absence of a publicly known exploit, the risk warrants prompt remediation.