Google Chrome’s WebGL implementation had insufficient validation of untrusted input, which could allow a remote attacker who had gained control of the renderer process to trigger a sandbox escape through a crafted HTML page. This flaw, classified as CWE‑20 and CWE‑1173, enables an attacker to break out of the renderer’s sandbox and potentially execute arbitrary code with elevated privileges, compromising confidentiality, integrity, and availability. The Chromium team rated the severity of this issue as Critical.

Google Chrome browsers running versions earlier than 148.0.7778.216 were affected. All operating systems that ship with these older Chrome builds are at risk until the upgrade to 148.0.7778.216 or later is performed.

The vulnerability is marked Critical and has a CVSS score of 8.3; its EPSS score is 0.00043 (approximately 0.043%), indicating a low probability of exploitation. Because the flaw requires a compromised renderer process and a maliciously constructed HTML page, the attack vector is remote. The lack of a current CISA KEV listing does not diminish the threat; the ability to escape the browser sandbox poses a high risk if an attacker can host or embed malicious content accessed by a user running the vulnerable Chrome version.