An attacker can exploit an unvalidated input in Google Chrome's Network layer to read data from process memory. This flaw, present in all Chrome builds before version 149.0.7827.53 and classified as an input validation flaw, allows a remote attacker who has already compromised the renderer process to craft a malicious HTML page that triggers the vulnerability and retrieves potentially sensitive information stored in renderer memory. The impact is limited to information disclosure; code execution or privilege escalation were not explicitly stated in the description, so this is inferred.

The vulnerability affects all desktop installations of Google Chrome running versions earlier than 149.0.7827.53 on Windows, macOS, and Linux.

Chromium rates the issue as medium severity. The flaw can only be exploited if the renderer process is already compromised, which is a non‑trivial prerequisite and not documented as a public exploit. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation. Nonetheless, users of unpatched browsers remain at risk of sensitive data exposure if a renderer compromise occurs through other vectors.