The vulnerability is a use‑after‑free in the GPU module of Google Chrome, identified as CWE‑416 and CWE‑825. It allows a remote attacker who has already compromised the renderer process to direct that process to manipulate freed GPU memory. By delivering a crafted HTML page, the attacker could use this memory reuse to escape the browser sandbox.

Google Chrome versions before 148.0.7778.216 on all supported operating systems in the stable channel are affected. The bug exists throughout the GPU memory management code integral to the browser’s rendering engine.

The CVSS score is 8.3, while the EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, indicating limited current exploitation activity. Exploitation requires an initial renderer sandbox escape, which currently has no publicly documented exploit. The potential impact is sandbox escape, which could enable further attacks should additional vulnerabilities be present.