A heap buffer overflow exists in SwiftShader within Google Chrome on Mac and iOS versions prior to 148.0.7778.168. When a specially crafted HTML page is loaded, an attacker can trigger an out‑of‑bounds memory read, exposing confidential data. The vulnerability does not provide code execution capabilities, but it can compromise the confidentiality of information stored in the browser process. The Chromium team has assessed the issue as Medium severity.

Google Chrome browsers running on macOS or iOS before build 148.0.7778.168 are affected. The flaw resides in the SwiftShader component and is specific to those platform builds.

Because the vulnerability is triggered by a crafted web page, the attack vector is remote via the browser. No exploits are known and the EPSS score is not available, while the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 4.3 indicates a medium level of risk, suggesting that, while exploitation is possible, it carries moderate risk without additional conditions such as elevated privileges.