An out‑of‑bounds read in V8 allows a remote attacker to read arbitrary data from process memory when a crafted HTML page is rendered, potentially exposing sensitive information. The weakness is an example of CWE‑125, which indicates invalid memory indexing during execution of a built‑in language engine. This flaw can compromise the confidentiality of data stored in the browser process.

Google Chrome for all platforms, including Windows, macOS, Linux, Android, and iOS, with any build older than 149.0.7827.53. Users running earlier versions are at risk until the vulnerability is mitigated by the vendor.

The vulnerability is not listed in CISA KEV and has an EPSS score of < 1%. Chromium reports the issue with a Medium severity level, reflected in a CVSS score of 6.5. The exploit can be delivered through a web page that the user opens or views, implying that remote or localized attacks are feasible. Until the vendor releases a patch, the risk remains moderate.