Technical impact
The vulnerability is a race condition in the GPU handling code of Google Chrome on Android prior to version 149.0.7827.53. An attacker who has already managed to compromise the renderer process can craft an HTML page that triggers the race, allowing the GPU to expose memory containing cross‑origin data. The weakness maps to CWE‑457 and CWE‑368, indicating a failure to initialize or enforce runtime checks and a race condition where a check and subsequent use are not correctly serialized.
Affected Systems
Affected systems are users of Google Chrome on Android before 149.0.7827.53. Any device running that build is susceptible until the patch is applied. Vendors have released a stable channel update that addresses the race.
Risk and Exploitability
The CVSS score is 6.5, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Exploitability requires a compromised renderer, which typically requires an initial foothold via another vulnerability. Therefore the risk to a fresh system is moderate, but once an attacker achieves renderer compromise the data leakage can be real. The attack vector is inferred to be local after renderer compromise, as the description implies a prerequisite of renderer compromise.
Debian DSA