Technical impact
A flaw in the animation handling code of Google Chrome allows a remote attacker to read sensitive data from the browser’s process memory by serving a specially crafted HTML page. The vulnerability stems from insufficient data validation within the animation subsystem, enabling an attacker to extract information that should be encapsulated. The exposed data could compromise user privacy or aid further attacks, but does not grant arbitrary code execution. The issue is classified as a medium‑severity information disclosure.
Affected Systems
All users running Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability is present in the stable channel and any derived builds of the browser running those legacy versions. Users of older stable releases or custom Chromium builds that do not incorporate the 149.0.7827.53 patch are at risk.
Risk and Exploitability
The attack vector is remote and requires the victim to visit a malicious webpage. The EPSS score of < 1% indicates a very low exploitation probability, and the fact that it is not listed in CISA KEV suggests no known active exploitation. The CVSS score is 6.5, and the Chromium severity is Medium, indicating a moderate confidence that exploitation is feasible but not widespread. Remediation is limited to upgrading the browser; no mitigating configuration change is known.
Debian DSA