A high-severity heap buffer overflow in Google Chrome’s ANGLE component could allow an attacker to gain control over an affected system via malicious web content.

This is a heap buffer overflow (CWE-122) within the ANGLE graphics library. It is remotely exploitable by unauthenticated attackers, requiring user interaction (UI:R) to trigger the vulnerable code path.

The CVSS score of 8.8 indicates a high risk of total system compromise. Successful exploitation could allow an attacker to execute arbitrary code, potentially leading to unauthorized data access and the deployment of further malicious payloads.

Immediate Action: Update all instances of Google Chrome to version 148.0.7778.216 or later.

Proactive Monitoring: Monitor for widespread browser instability or unusual heap-related error logs in security telemetry.

Compensating Controls: Deploy endpoint protections that include memory protection features, such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), to increase the complexity of successful exploitation.

Public Exploit Available: Unknown

Immediate patching is required to address this vulnerability. Ensure that all browser updates are deployed across the fleet to mitigate the risk of remote code execution.