The vulnerability resides in the DevTools implementation of Google Chrome. Prior to version 149.0.7827.53, a malicious Chrome extension could craft a request that allows read access to process memory of the Chrome browser process. This can expose potentially sensitive information such as authentication tokens, passwords or personal data that reside in memory. The weakness is a form of information disclosure due to inadequate access controls on DevTools memory‑read operations.

Google Chrome browsers running any Chrome version prior to 149.0.7827.53 are affected. The issue was fixed in Chrome 149.0.7827.53 and later releases.

The exploit requires a user to install a compromised extension, so the attack vector is user-mediated. The CVSS base score is not published in the data, but the Chromium security severity is listed as Low. EPSS is not available and the vulnerability is not in CISA’s KEV catalog. Because the attack depends on user interaction, the likelihood of exploitation is limited, but any user who installs a malicious extension could inadvertently expose sensitive data.