The vulnerability is an out‑of‑bounds read in WebRTC on Google Chrome versions prior to 149.0.7827.53. A malicious web page can trigger the bug and allow a remote attacker to read arbitrary data from the browser’s process memory. The consequence is potentially sensitive information disclosure, identified as CWE-125.

The affected product is Google Chrome built on the Chromium engine. Any desktop installation of Chrome before version 149.0.7827.53 is vulnerable, unless the user has already applied the update released in the June 2026 stable channel.

Public exploitation is not recorded in the KEV catalog and no EPSS score is available, so the likelihood cannot be quantified. The advisory rates the severity as Medium, and the attack vector is remote through a crafted HTML page that induces an out‑of‑bounds read. Until the patch is applied, an attacker who can host a malicious page accessed by the victim can leak process memory contents.