In Google Chrome versions prior to 149.0.7827.155, an inadequate implementation in the media subsystem allows a remote attacker to read contents of process memory from a specially crafted HTML page. The exposed data may include sensitive information that a user has loaded or is processing. This flaw is a classic example of information disclosure (CWE‑200).

The vulnerability affects Google Chrome installations using any version earlier than 149.0.7827.155. Users running these releases are at risk of memory leakage until they update to a fixed build.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The flaw has not been listed in the CISA KEV catalog. Exploitation requires an attacker to entice the victim to open a maliciously crafted webpage in Chrome, leaking memory contents to the attacker. Because the vulnerability is triggered by in-process media handling, the attack vector is likely a remote web‑based intrusion rather than a local privilege escalation.