An out‑of‑bounds write in the GPU subsystem of Google Chrome could allow a malicious renderer process to write outside its intended memory buffer, potentially enabling an attacker who has already compromised the renderer to execute arbitrary code beyond the browser sandbox. The flaw is classified as high severity and permits code execution without requiring additional vulnerabilities. This can compromise confidentiality, integrity, and availability of the system hosting the browser. The CVE description specifies that a crafted HTML page accessed by a compromised renderer process can trigger the failure.

All installations of Google Chrome using versions prior to 154.0.8037.92 are affected. Google Chrome is the sole vendor listed, with the vulnerability disclosed before the release of the mentioned patch version. Any system running Chrome that has not yet been updated to the patched build remains at risk.

The flaw carries a CVSS score of 8.3, indicating high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a malicious webpage served to a user who has already managed to compromise the renderer process; no network‑level exploitation is required beyond the ability to deliver crafted HTML content. Given the lack of exploitation probability data, the risk remains primarily tied to the presence of the flaw and the potential for an attacker to force execution of code within the browser context.