Sandbox escape via Crashpad heap overflow

Heap buffer overflow in Crashpad in Google Chrome on Android before 107.0.5304.106 allows remote attackers to escape the sandbox via crafted HTML. The Crashpad component writes beyond a heap buffer when processing data delivered from a renderer that has already been compromised, enabling memory corruption during handling of a malicious page. The attack requires renderer-process compromise and user loading of attacker-controlled HTML; the resulting impact is a potential sandbox escape with code execution outside the renderer sandbox.