This vulnerability involves an out-of-bounds read in the GPU subsystem of Google Chrome on Linux platforms before version 148.0.7778.168. An attacker with control over the renderer process can exploit this flaw to leak data across origins by crafting malicious HTML content. The issue is recognized and published by the Chrome project, but no CVSS score or detailed remediation status is included in the provided information. The vendor advisory points to a stable channel update that likely addresses this issue.

The vulnerability enables information disclosure through cross-origin data leakage if the attacker has already compromised the renderer process. This could lead to exposure of sensitive data from other origins within the browser context. There are no reports of active exploitation in the wild at this time.

A fix is implied by the presence of the Chrome stable channel update referenced in the vendor advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html). Users should update Google Chrome on Linux to version 148.0.7778.168 or later to remediate this vulnerability. Patch status is not explicitly confirmed in the input data; therefore, checking the vendor advisory for the latest remediation guidance is recommended.