Technical impact
An out-of-bounds read exists in the Chromecast component of Google Chrome. The flaw involves an unchecked buffer access (CWE-125) combined with inadequate input validation (CWE-20). A compromised renderer process can read memory beyond intended buffers, potentially leaking sensitive data to an attacker through a crafted web page. This allows an attacker to obtain confidential information, but only if the attacker first gains the privilege to inject data into the renderer process; it does not grant code execution or unrestricted system access.
Affected Systems
The vulnerability affects Google Chrome browsers prior to version 149.0.7827.53 on all platforms that include the Chromecast feature. It does not impact older browsers that omit Chromecast or running chromeless instances without that module.
Risk and Exploitability
The CVSS score is 6.5, indicating a medium severity. The EPSS score is under 1%, reflecting a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The attack vector requires a compromised renderer process and a crafted HTML/Chromecast payload, making exploitation more complex. However, because the renderer typically runs with elevated privileges, a successful read could lead to significant data exposure if combined with other foothold conditions.
Debian DSA