A flaw in Google Chrome’s Media module allows a local network attacker to send specially crafted traffic that causes the browser to read memory beyond the intended bounds, exposing sensitive data stored in memory such as passwords or cryptographic keys. This is a classic out‑of‑bounds read weakness, identified as CWE‑125.

Google Chrome versions prior to 149.0.7827.53 on desktop platforms are vulnerable.

The CVSS score is 4, classified as Medium in Chromium’s internal severity, with no EPSS score published and no listing in the CISA KEV catalog. Exploitation requires the attacker to be able to inject malicious traffic onto the victim’s local network segment, typically via broadcast or multicast streams. While the exploit does not provide remote code execution, it enables memory disclosure that could reveal privileged information if the attacker observes the victim’s session data. Given the local‑network requirement and lack of publicly known exploits, the likelihood of widespread exploitation is moderate but not negligible.