## Summary
Google Chrome before 146.0.7680.153 contains a heap buffer overflow in WebAudio. A remote attacker can trigger the issue via a crafted HTML page, leading to arbitrary code execution inside a sandbox.
## Technical Details
- Vulnerability type: heap buffer overflow in WebAudio (CWE-122)
- Affected component: WebAudio in the browser
- Attack scenario: a crafted HTML page delivered over the network
- Impact scope: code execution occurs inside a sandbox (not full system compromise implied by the description)
## Affected
- google chrome versions: < 146.0.7680.153
## Impact
- Remote attacker can achieve arbitrary code execution inside a sandbox
- Consequences indicated by the NVD description: confidentiality, integrity, and availability impact are all high (C:H/I:H/A:H in the provided CVSS vector)
## Mitigation
1. Upgrade google chrome to 146.0.7680.153 or later to eliminate the vulnerable WebAudio code path.
2. Treat untrusted HTML content as hostile; restrict exposure to attacker-controlled pages (e.g., via browser isolation policies) until patched.
3. Monitor for exploitation attempts consistent with malicious page delivery targeting WebAudio (e.g., unusual crashes or renderer instability following visits to untrusted pages).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-122