This vulnerability arises from insufficient validation of untrusted input in the GPU component of Google Chrome. When an attacker can compromise the renderer process, they can craft a malicious HTML page that triggers a crash, leading to a denial of service. The weakness centers on improper input validation (CWE‑20, CWE‑1173), affecting the availability of the system. The impact is a denial of service that can be triggered remotely once the attacker has compromised the renderer process. It does not expose credentials or data, but it can disrupt user sessions and web content rendering.

Affected product is Google Chrome for all users running versions prior to 148.0.7778.168. The exact version range is not listed beyond the specified earlier release. No other vendors or products are noted.

The vulnerability carries a medium severity rating of 5.3 on the CVSS scale. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, indicating no documented widespread exploitation to date. The attack requires that the attacker already has control over the renderer process, which is typically achieved through exploitation of additional local privilege or code‑execution vulnerabilities. Once achieved, the attacker can manipulate a crafted HTML page to cause a crash.