The vulnerability arises from an information leak in the Audio component of Google Chrome. An attacker who already has control over the renderer process—such as through a malicious extension—can read memory beyond the sandbox’s boundaries, exposing sensitive data that resides in other processes. This flaw allows disclosure of proprietary or personal information without executing arbitrary code on the host.

Google Chrome desktop builds prior to 155.0.8059.39 are affected. The issue was fixed in the stable channel update released in October 2026, which isolates the audio module and prevents the memory read.

The CVSS score is 4.0, indicating medium severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers require control of the renderer process, which can be obtained via a malicious extension. With this foothold, they can read arbitrary memory beyond the sandbox, exposing sensitive data. This information disclosure risk is medium but still necessitates mitigation to prevent possible leaks.