The vulnerability manifests as an out‑of‑bounds read in the extension handling code of Google Chrome on Linux. An attacker who persuades a user to install a crafted extension can read sensitive data from the browser process memory. This flaw can lead to disclosure of confidential information. The weakness involves classic buffer‑overflow style errors (CWE‑122 and CWE‑125).

Google Chrome running on Linux is affected. Versions prior to 149.0.7827.53 are vulnerable; no further version details are provided.

The flaw does not allow remote code execution; the attacker must supply a malicious extension and persuade the user to install it. Because exploitation requires social engineering, the risk is moderate. The EPSS score is less than 1%, indicating a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score is 6.5, which denotes moderate severity.