The vulnerability is an out‑of‑bounds write in the GPU code path of Google Chrome prior to version 148.0.7778.216. It can be triggered by a remote attacker who has already compromised the renderer process through a crafted HTML page, allowing the attacker to escape the renderer sandbox and potentially execute arbitrary code on the host.

Affected users are those running any Google Chrome desktop version before 148.0.7778.216. The flaw applies to all builds that include the vulnerable GPU driver integration in the Chrome rendering pipeline. It is likely that the affected platforms include Windows, macOS, and Linux, inferred from Chrome's typical desktop distribution.

Chromium lists the flaw as high severity, and the CVSS score is 9.0. The EPSS score is below 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires compromising the renderer process and delivering a malicious HTML page. While no public exploit is known, the nature of the sandbox escape poses a high risk to confidentiality, integrity, and availability of affected systems.