The vulnerability is an out‑of‑bounds write in the Imagination Technologies Graphics DDK, triggered by WebGPU data supplied by a web page. The driver calculates the required memory buffer size from untrusted input, and an integer overflow can cause the size to be smaller than required. A subsequent memory write then extends past the allocated buffer, corrupting adjacent memory. This corruption can result in a crash of the GPU WebGL/GLES rendering process and could expose sensitive data or allow further exploitation within the browser environment. The identified weakness is CWE‑787: Out‑of‑Bounds Write.

Imagination Technologies Graphics DDK products used in web browsers that enable WebGPU. Specific affected versions are not disclosed in the available data.

The CVSS score is not provided, but the lack of an EPSS score and absence from CISA KEV suggest that while the vulnerability could be exploited locally within a browser session, it is not currently known to be widely leveraged in the wild. Attackers would need to supply a crafted WebGPU payload to a target web page to trigger the overflow, making the attack vector client‑side or local.