Technical impact
An attacker can exploit an unvalidated input in Google Chrome's Network layer to read data residing in renderer process memory. The vulnerability, present in all Chrome builds before version 149.0.7827.53, is an input validation flaw that allows a remote attacker who has already compromised the renderer process to craft a malicious web page that triggers the defect and leaks potentially sensitive information stored in memory. The impact is limited to information disclosure; the description does not mention code execution or privilege escalation, so those outcomes are not supported by the data.
Affected Systems
The vulnerability affects all desktop installations of Google Chrome running versions earlier than 149.0.7827.53 on Windows, macOS, and Linux.
Risk and Exploitability
Chromium rates the issue as medium severity (CVSS 6.5). The EPSS score is below 1%, suggesting a very low likelihood of exploitation under normal circumstances. The flaw can only be exploited if the renderer process has already been compromised, which is a non‑trivial prerequisite and not documented as a public exploit. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation. Nonetheless, users of unpatched browsers remain at risk of sensitive data exposure if a renderer compromise occurs through other vectors.
Debian DSA