An out-of-bounds write vulnerability exists in the Fonts handling of Google Chrome before version 148.0.7778.168. This memory corruption flaw can be triggered remotely via a specially crafted HTML page, enabling arbitrary code execution within the sandboxed environment of the browser. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting its network attack vector, low attack complexity, no privileges required, and user interaction needed. The issue affects desktop versions of Chrome and has been publicly disclosed with a vendor advisory providing an update to remediate the flaw.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code inside the Chrome sandbox, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized actions within the browser context, though sandbox restrictions may limit broader system impact. No known active exploits have been reported.

A stable channel update for Google Chrome version 148.0.7778.168 has been released to address this vulnerability. Users and administrators should apply this official update promptly to remediate the issue. Since this is a client-side application, patching the browser is the primary mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.