The vulnerability is a race condition in CacheStorage in Google Chrome before version 155.0.8059.39. It allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox via a crafted HTML page, potentially exposing sensitive data stored in memory. The weakness is identified as CWE-367.

Affected is Google Chrome for all platforms. The vulnerable version is any release prior to 155.0.8059.39. The issue applies to all desktop Chrome builds.

The CVSS score is 4.7 and the EPSS score is < 1%, but Chromium listed the severity as Medium, indicating a moderate threat. Exploitation requires the attacker to first compromise the renderer process; once that occurs the attacker can read out‑of‑sandbox memory with relatively low effort. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious web page that triggers the cache race after the renderer has been compromised.