The vulnerability is an out‑of‑bounds read in the GPU handling path of Google Chrome on macOS. A crafted HTML page can trigger a read of arbitrary data from the browser process memory, potentially exposing sensitive information. This flaw falls under CWE‑125 and could allow a remote attacker to obtain confidential data without privileged access.

Affected are users of Google Chrome on macOS running any version prior to 148.0.7778.179. The issue is present in the stable channel before that build. No other vendor or product versions are impacted.

Chromium’s internal metrics rate the issue as medium severity, with a CVSS score of 6.5. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by hosting a malicious web page that the victim opens in Chrome, leading to a remote data leak. No specific authentication or elevated privileges are required, and the exploit does not disrupt service availability.