The vulnerability is a buffer overread (CWE-119) in the Chrome Core component that occurs when rendering a specifically crafted HTML page. The overread permits the attacker to read arbitrary memory from the renderer process, exposing potentially sensitive data. The impact is information disclosure. The description indicates a memory corruption that is triggered by a remote attacker through an HTML page.

Google Chrome desktop browsers prior to version 155.0.8059.84 are impacted. This includes the stable channel, and it is likely that earlier beta or dev branches may also be vulnerable until the upgrade is applied.

The CVSS score of 4.3 indicates moderate severity. The exploit requires a remotely hosted HTML page; the likely attack vector is the user opening a malicious site, which is inferred from the need to load a crafted page. Because the EPSS score is not available, the actual likelihood of exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The available mitigations rely on updating the browser, and the risk is reduced by preventing the attacker from delivering the malicious page.