The flaw is caused by an improper bounds check in Chrome's LiveCaption feature, allowing a crafted network packet to trigger an out‑of‑bounds read in memory handling code. This leads to memory corruption that could be leveraged for exploitation. The flaw is classified as CWE‑125 and has been rated low severity by Chromium."

Google Chrome versions older than 149.0.7827.53 are affected; any system running those builds is at risk, including desktop and possibly mobile deployments. The patch is available in the stable channel update for Chrome.

No public EPSS score is available and the vulnerability is not listed in CISA's KEV catalog, indicating low immediate exploitation risk. An attacker would need to send malicious traffic to a Chrome instance with Live Caption enabled; there are no known active exploits, but the memory corruption could potentially be used for remote code execution in certain contexts.