The vulnerability is a use‑after‑free flaw in the Bindings component of Google Chrome that allows a remote attacker to read memory inside the sandbox through a crafted HTML page, potentially exposing sensitive data. The flaw was classified as high severity by Chromium, indicating that the attacker can achieve confidential information disclosure. The issue does not provide a path to arbitrary code execution or denial of service, but it does compromise memory confidentiality.

Google Chrome versions prior to 155.0.8059.79 on all supported platforms are affected. The bug is fixed in Chrome 155.0.8059.79 and later releases. This includes the stable channel update announced on the Chromium blog for October 2026.

The CVSS score of 4.3 reflects a low impact and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, further suggesting that a widespread, targeted exploit has not been observed. The attack requires the user to load a specially crafted HTML page, meaning that an attacker must lure the victim to a malicious site or use social engineering to execute the payload. Given the low overall risk and limited impact, mitigations should still be applied.