The vulnerability is an out‑of‑bounds read in the Media module of Google Chrome on ChromeOS. A malicious web page that successfully compromises the renderer process can cause Chrome to read arbitrary data from process memory. The result is that the attacker can acquire potentially sensitive information that resides in the renderer’s memory space. The weakness corresponds to CWE‑472 and CWE‑125.

The flaw affects all installations of Google Chrome running on ChromeOS before version 149.0.7827.103. Any device that has that browser version and allows potentially hostile web content to be rendered is susceptible.

The issue is rated high severity in Chromium security. The CVSS score is 5.3, which corresponds to a medium level of severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and it is not listed in the CISA KEV catalog. Exfiltration would require the attacker to first gain control of the renderer process, which is likely obtained via malicious HTML content delivered to the user. If that control is obtained, the out‑of‑bounds read allows extraction of memory contents, thus presenting a serious information‑disclosure risk. The required privilege level is limited to the renderer process, but the potential impact spans all data held within that process.