The bug is an inappropriate implementation in the V8 JavaScript engine of Google Chrome. It allows a remote attacker to trigger an out‑of‑bounds memory read by serving a crafted HTML page. The attacker can read arbitrary data from the victim’s process memory, potentially revealing sensitive information. This weakness is classified as CWE‑474 and is scored with a CVSS score of 8.8, indicating a high impact if exploited.

The vulnerability applies to Google Chrome versions prior to 144.0.7559.59 on all supported operating systems. The affected platforms include Windows, macOS, and Linux, as reflected by the CPEs for those operating systems. Any device running Chrome below the specified patch level is susceptible regardless of the underlying OS.

The CVSS rating highlights significant severity, but the EPSS score of less than 1 % suggests that exploitation attempts are currently rare and unlikely to be prominent in the wild. The vulnerability has not yet been listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a user to open a maliciously crafted web page, implying a client‑side, user‑interaction attack vector. Because the flaw permits only memory reading, it does not provide command execution or full process takeover.