An out‑of‑bounds image processing bug exists in the GPU subsystem of Google Chrome for macOS. The flaw allows a remotely served, crafted HTML page to cause the GPU to read memory beyond its intended bounds, potentially exposing sensitive data stored in the browser process. The vulnerability is a classic buffer bounds checking weakness, classified as CWE‑125, and its official severity is noted as high.

Google Chrome running on macOS versions prior to 148.0.7778.179 are affected. The attack affects all users on the Chrome stable channel before the specified patch version.

The CVSS score of 4.3 indicates a moderate risk level, and no EPSS score is available to indicate current exploitation probability. The vulnerability is not registered in CISA’s KEV catalog, showing no public widespread exploitation as of the data available. Attackers must be able to serve the malicious web page over the network to the target user; the vector is thus network‑based via the browser, requiring the victim to render the crafted page.