An out‑of‑bounds read occurs within Chrome’s video processing code on ChromeOS. When a renderer process is already compromised, a specially crafted HTML page can trigger the read, allowing the attacker to access potentially sensitive data stored in the renderer’s memory. This is an information‑disclosure vulnerability with a high severity rating from Chromium’s security team.

The flaw impacts Google Chrome running on ChromeOS prior to version 149.0.7827.115. All installations of that browser version are susceptible when they host untrusted web content that causes the renderer to execute the vulnerable video routine.

Based on the description, it is inferred that attackers must already have attacker control of the renderer process to exploit this weakness. The CVSS score of 5.3 indicates medium severity, and the EPSS score of < 1% indicates a very low exploitation probability. It is not listed in CISA’s KEV catalog. Even without a published exploit, the potential to read arbitrary memory makes it a serious risk for exposed systems.