This vulnerability is an out-of-bounds read in the VideoCapture feature of Google Chrome that allows a remote attacker who has already compromised the GPU process to read arbitrary memory in the process. The attacker can feed a specially crafted HTML page to trigger the memory read, potentially exposing sensitive data. It is classified as Memory Access Violation (CWE-125) and is rated as high severity.

Affected versions are all stable-channel releases of Google Chrome before 149.0.7827.115, which include the problematic VideoCapture code. Users running those versions on any platform that enables GPU acceleration are vulnerable.

The exploit requires the attacker to first gain control of the GPU process, a step that is non-trivial and may limit real-world exploitation. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. Still, because the flaw can leak data and has a high CVSS rating, administrators should treat it as a significant risk until patched.