This vulnerability stems from an inappropriate implementation in DevTools within Google Chrome prior to build 149.0.7827.53. After a remote attacker has already compromised the renderer process, a crafted HTML page can trigger DevTools to read arbitrary data from the renderer’s memory. The flaw represents a memory‑safety weakness (CWE‑416) combined with an access‑control weakness (CWE‑497). The leaked data may include session cookies, authentication tokens, or other confidential information, thereby enabling the attacker to exfiltrate sensitive data or impersonate users.

Google Chrome browsers with versions before 149.0.7827.53 are affected. The issue is confined to the DevTools component of the renderer process and does not propagate to other vendor products or operating systems listed in the CPE set.

The CVSS score of 9.6 signals a high severity, yet the EPSS score is less than 1% and the vulnerability is not yet in the CISA KEV catalog, indicating a low probability of widespread exploitation. However, the exploit remains feasible for an attacker who can first gain control of the renderer process. Once that prerequisite is satisfied, any malicious HTML page served to the compromised instance can leverage DevTools to read memory, leading to information disclosure. Chrome users exposed to untrusted web content and without strict renderer isolation face a significant risk, even though achieving the initial renderer compromise is a prerequisite.