Out of bounds write occurs in the GPU code of Google Chrome before version 148.0.7778.216 and can be triggered by a crafted HTML page displayed in a compromised renderer process; the flaw, a classic CWE-787 buffer overrun, allows the attacker to corrupt memory and potentially escape the renderer sandbox to execute code with higher privileges.

Google Chrome browsers on any operating system that are running a version earlier than 148.0.7778.216 are affected; the issue is limited to the renderer process and is triggered by maliciously crafted or compromised web content.

The CVSS score of 9.0 indicates critical severity and, though the EPSS score is less than 1 %, the high Chromium severity and absence from the KEV catalog still make exploitation a serious threat; the attack requires first compromising the renderer process, which can be achieved by a malicious web page or an existing vulnerability, after which the sandbox escape could provide system-wide access.