A remote attacker can trigger an out-of-bounds memory read in the WebGPU implementation of Google Chrome by serving a specially crafted HTML page. The read can expose contents from memory that the browser is not supposed to access, potentially leaking sensitive data. Chromium tags this as a Medium severity vulnerability, indicating the threat is notable but not immediately catastrophic.

The flaw affects all installations of Google Chrome running versions prior to 149.0.7827.53, across all supported platforms where Chrome uses the WebGPU API.

The exploit requires the victim to load the malicious HTML page, so it is a remote, client‑side vulnerability. The EPSS score for this issue is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the local WebGPU context can read unbounded memory, an attacker with access to the victim’s browser could obtain arbitrary data from the process. Mitigation is time‑critical, and lack of a public EPSS score suggests the exploitation probability is uncertain but non‑negligible.