The vulnerability is an out‑of‑bounds write in Chrome’s GPU code path (CWE‑787). A crafted HTML page can trigger the write, potentially breaking out of the browser process sandbox and allowing an attacker to gain higher privileges and execute arbitrary code within the browser session.

Affected product is Google Chrome. Versions older than 148.0.7778.216 are vulnerable. No operating system is specified, so the issue likely applies to all Chrome installations that use the GPU code path.

Chromium rates the issue as high severity with a CVSS score of 9.3. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. An attacker can exploit it remotely by loading a malicious webpage that triggers the out‑of‑bounds write. Although no publicly documented exploit is available, the nature of the flaw permits memory corruption that could lead to sandbox escape. Theoretical risk exists but the high severity and remote nature warrant prompt patching.