The vulnerability is an out‑of‑bounds read in the GPU component of Google Chrome that can be triggered when a renderer process is already compromised. If the attacker can supply a crafted HTML page, the read may allow the renderer to escape its sandbox and gain higher privileges on the host. This could lead to arbitrary code execution or other elevated‑privilege attacks while the user remains unaware.

Google Chrome versions prior to 148.0.7778.216 are vulnerable. The affected component is the GPU subsystem of the Chrome browser on all platforms that include the renderer process.

The CVSS score is 8.2, indicating a high severity vulnerability. No EPSS score is available, so publicly known exploitation probability is uncertain. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to compromise the renderer process, which is typically sandboxed, and then serve a malicious webpage to trigger the exploit. While the attack surface is reduced, the potential impact of sandbox escape makes it a high‑risk flaw for users running vulnerable Chrome versions.