An integer overflow in the GPU component of Google Chrome, triggered by a compromised renderer process, permits a remote attacker to extract cross‑origin data from a crafted HTML page. The flaw acts at the GPU driver level and can expose sensitive information from other web sites visited in the same browser session. The associated weakness is integer overflow (CWE–190).

Google Chrome desktop releases prior to version 151.0.7922.109 on Windows, macOS, and Linux are vulnerable. Users on the stable channel who have not updated to 151.0.7922.109 or later remain exposed.

The vulnerability has a CVSS score of 3.1, but Chromium assigns a security severity of High, indicating a potentially significant risk to data confidentiality. The EPSS score of <1% suggests a low exploitation probability, and the vulnerability is not listed in CISA KEV, meaning no widespread exploitation has been reported. The likely attack vector involves an attacker compromising the renderer process and delivering a malicious HTML page. While it does not provide remote code execution, the resulting data leakage could assist in credential theft or other privacy‑breach attacks.