An out‑of‑bounds write occurs in the GPU user‑space driver when a web page contains atypical WebGPU content that is loaded into the GPU GLES render process. The driver writes beyond the boundary of the allocated memory area, corrupting adjacent data, which can cause the GPU process or browser to crash and may lead to undefined behaviour. The vulnerability is characterized as a classic out‑of‑bounds write weakness (CWE‑787).

The affected component is the Imagination Technologies Graphics DDK, which implements the GPU driver for systems that use Imagination Technologies’ graphics stacks. No explicit version information is provided; any installation of this DDK that has not yet adopted the vendor’s mitigation will be vulnerable. The vulnerability can be triggered by a malicious web page that includes uncommon WebGPU instructions.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting there is currently no known exploitation in the wild. However, a local attacker who can cause a web page to load malformed WebGPU data could trigger the unsafe memory access, potentially leading to a crash or, in the worst case, arbitrary code execution if the memory corruption can be exploited. The lack of publicly available exploit packages means the risk is primarily theoretical at this time, but the core flaw is severe enough to warrant prompt remediation.