A remote attacker can trigger an out‑of‑bounds memory read in the WebGPU implementation of Google Chrome by serving a specially crafted HTML page. The read can expose contents from memory that the browser is not supposed to access, potentially leaking sensitive data. Chromium tags this as a Medium severity vulnerability, indicating the threat is notable but not immediately catastrophic.

The flaw affects all installations of Google Chrome running versions prior to 149.0.7827.53, across all supported platforms where Chrome uses the WebGPU API.

The exploit requires the victim to load the malicious HTML page, so it is a remote, client‑side vulnerability. The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Because the local WebGPU context can read unbounded memory, an attacker with access to the victim’s browser could obtain arbitrary data from the process. The CVSS score is 8.1, reflecting a high severity. Mitigation should be applied, but the exploitation probability remains low but non‑negligible.