A heap buffer overflow occurs in the Skia graphics engine used by Google Chrome. When a specially crafted HTML page is loaded, the overflow can read beyond the bounds of a heap buffer and expose data from the browser process memory. This flaw is classified as CWE‑122 and CWE‑125 and, according to Chromium’s own assessment, it has a medium severity level.

All users running Google Chrome on the stable channel prior to version 149.0.7827.53 are affected. The vulnerability exists in the Skia code path that Chrome uses and is not limited to any particular operating system.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been documented. Nonetheless, the flaw enables an attacker to read arbitrary memory contents from the browser process, potentially disclosing sensitive information from the victim’s browser session. The likely attack vector is a malicious web page that a user visits; once that page is rendered, the memory leakage can occur with no further interaction.