An out‑of‑bounds read bug in Chrome’s FileSystem component enabled a remote attacker to read memory inside the browser sandbox through a specially crafted HTML page. This flaw leads to a confidential data leak, allowing the attacker to disclose privileged memory content. The Chromium security team rated the vulnerability as medium severity.

The issue affects Google Chrome installations running versions older than 156.0.8078.79. The advisory explicitly mentions the stable channel, which is an inference that the vulnerability applies to that channel. Any user of a pre‑156.0.8078.79 build is potentially vulnerable if they visit a malicious web page crafted to trigger the bug.

The EPSS score is not reported and the flaw is currently not listed in CISA’s KEV catalog, suggesting limited known exploitation. However, the vulnerability requires a remote attacker to deliver a crafted HTML page via the internet, which is a realistic attack vector for web‑based threats. The medium severity rating indicates that exploitation could lead to significant confidentiality impact but likely would not enable broader system compromise.