An integer overflow in the libyuv library of Google Chrome prior to version 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to read sensitive data from process memory by loading a specially crafted HTML page. This flaw, classified as CWE-190 and CWE-472, is a memory disclosure vulnerability that can expose user data, and is rated high severity by Chromium.

The vulnerability impacts Google Chrome running on all platforms prior to version 149.0.7827.103, including the 149.0.7827.102 build and all earlier stable releases. Users and administrators should ensure they are using the patched 149.0.7827.103 release or later.

Because the exploit requires initial compromise of the renderer process, the attack chain is partial but feasible for attackers able to deliver malicious content. The EPSS score of <1% indicates very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. However, a CVSS score of 5.3 indicates medium severity, suggesting that once the renderer is compromised, the attacker can potentially read arbitrary memory.