This bug is an out‑of‑bounds read and write in the WebGL subsystem of Google Chrome, identified by CWE-125 and CWE-787. It allows a remote attacker to trigger arbitrary memory reads and writes by loading a specifically crafted HTML page, which can corrupt the browser process, leak sensitive information, or enable execution of arbitrary code within the user’s context.

All supported operating systems—Windows, macOS, and Linux—running Google Chrome versions earlier than 146.0.7680.153 are vulnerable. The flaw is present in every Chrome build prior to that release, regardless of the platform.

The base CVSS score is 8.8, indicating a high severity, while the EPSS score is below 1%, suggesting that active exploitation is currently unlikely. The bug is not listed in the CISA KEV catalog. Based on the description, a remote attacker can exploit the vulnerability by visiting a malicious web page, which triggers the out‑of‑bounds memory actions. No user privilege escalation is required, but malicious code can run in the user's browser context.