A heap buffer overflow occurs in the Skia graphics engine that is used by Google Chrome. When a specially crafted HTML page is loaded, the overflow can read beyond the bounds of a heap buffer and expose data from the browser process memory. This flaw is classified as CWE‑122 and, according to Chromium’s own assessment, it has a medium severity level.

All users running Google Chrome on the stable channel prior to version 149.0.7827.53 are affected. The vulnerability exists in the desktop build of Chrome and does not apply to earlier versions or to Chrome on other platforms that are not using the same Skia code path.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been documented to date. However, because the flaw allows an attacker to read arbitrary memory contents, the potential impact is the disclosure of sensitive information from the victim’s browser session. The likely attack vector is via a malicious web page that a user visits, meaning that the attacker cannot remotely trigger the flaw without the user opening a crafted HTML page, but once that page is opened the memory leakage can occur with no further interaction needed.