The vulnerability arises from improper state validation in the GPU component of Google Chrome. Prior to update 157.0.8103.38, a remote attacker who already compromised the renderer process could supply a specially crafted HTML page that triggers GPU operations, leading to execution of arbitrary code outside the renderer sandbox. This bypass undermines the browser’s security model and could allow attackers to read protected data, modify system state, or install malware. Based on the description, it is inferred that the attacker must first gain control of the renderer process to exploit the GPU validation flaw; the exact method for that initial compromise is not detailed in the advisory.

Google Chrome desktop versions older than 157.0.8103.38 are affected. The flaw exists in all platforms that ship the listed version prior to the patch release.

Chromium labels the issue as high severity, but EPSS is not available and the vulnerability is not listed in CISA KEV. This suggests no widespread exploitation yet, yet the potential for full system compromise is significant once the renderer process is compromised. Exploitation requires a crafted Web page and a rendering component already under attacker control, indicating a moderate to high difficulty. The absence of public exploits does not reduce the risk for systems that have not yet applied the patch.