Technical impact
The flaw is caused by an improper bounds check in Chrome's LiveCaption feature, allowing a crafted network packet to trigger an out‑of‑bounds read in memory handling code. The out‑of‑bounds read constitutes a buffer over-read vulnerability, which is a CWE‑125, and the potential for exploitation also corresponds to CWE‑787. The flaw leads to memory corruption that could be leveraged for exploitation. It has been rated low severity by Chromium.
Affected Systems
Google Chrome versions older than 149.0.7827.53 are affected; any system running those builds is at risk, including desktop and possibly mobile deployments. The patch is available in the stable channel update for Chrome.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity, but the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, indicating no known active exploits. An attacker would need to send malicious traffic to a Chrome instance with Live Caption enabled; there are no known active exploits, but the memory corruption could potentially be used for remote code execution in certain contexts.
Debian DSA