An out‑of‑bounds read vulnerability in the WebGL implementation of Google Chrome for Android allows a remote attacker to exfiltrate cross‑origin data through a specially crafted HTML page. The flaw causes the graphics engine to read memory beyond the intended buffer, exposing sensitive information that should be protected by the same‑origin policy. This represents a privacy breach and confidentiality risk that can be triggered simply by loading a malicious webpage.

All Android installations of Google Chrome prior to version 148.0.7778.216 are vulnerable when they load a page with crafted WebGL requests. Versions 148.0.7778.216 and later contain the fix.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale exploitation yet. Exploitation requires no local privileges, only that a user visits a malicious webpage in the affected browser.