An incorrect authorization check in the GPU subsystem of Google Chrome on macOS, present before version 153.0.8010.36, allows a remote attacker who has already compromised the renderer process to obtain data from other origins through a crafted HTML page. The vulnerability is a classic authorization flaw (CWE‑863) that can lead to confidentiality loss and data leakage.

Google Chrome for macOS releases older than 153.0.8010.36 are affected. The flaw exists in the GPU handling code of the browser and is independent of network topology, requiring only a compromised renderer process to succeed.

The vulnerability is rated medium in Chromium’s internal severity list, with an external CVSS score of 3.1, and the EPSS score is 0.002, indicating a very low but not zero probability of exploitation, and it is not listed in CISA’s KEV catalog. Attackers would need to first gain control over the renderer process—potentially through another vulnerability or malicious site—before exploiting the GPU authorization issue. The lack of publicly available exploit data suggests that immediate risk is moderate, yet the guaranteed path to cross‑origin data access makes it a serious concern for any environment that accepts untrusted web content.