An out-of-bounds read occurs in the GPU rendering engine of Google Chrome prior to version 148.0.7778.179. The flaw can lead to heap corruption when a specially crafted HTML page is rendered. This vulnerability is identified as CWE‑125 and, if successfully exploited, could allow an attacker to alter memory contents and potentially execute arbitrary code or interrupt normal execution flow. The official severity noted by Chromium is Medium, indicating that while exploitation is not trivial, the resulting impact could be significant.

The affected vendor is Google and the product is Chrome. All Chrome installations with a build prior to 148.0.7778.179 are at risk. No specific operating system limitation is indicated, so users on any platform running an unsupported Chrome build may be vulnerable.

The attack vector is inferred to be remote, exploiting the vulnerability through a crafted webpage that a user opens or visits. Because the flaw involves heap corruption, an attacker would need to trigger a render of the malicious content. The CVSS score of 8.8 indicates high severity, and although the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting limited confirmed exploitation. The Chromium severity rating of Medium reflects a moderate likelihood of exploitation if the user visits compromised sites or opens harmful payloads.