An out‑of‑bounds read vulnerability exists in Chrome's Offline component for Android devices running versions before 156.0.8078.47. A crafted HTML page can force the rendering engine to read memory beyond a buffer, potentially exposing data from within the Chrome sandbox. The flaw is identified as CWE‑125 and is deemed medium severity by Chromium.

Google Chrome on Android; all releases prior to 156.0.8078.47 are vulnerable, newer versions contain the fix.

The EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog, implying limited public exploitation to date. The CVSS score of 6.5 indicates medium severity. The attack requires a remote victim to open a malicious HTML page, which could be delivered through a compromised or malicious website. While the medium classification and lack of known exploits suggest a lower baseline risk, successful exploitation could expose confidential data from the sandbox.