An out‑of‑bounds read vulnerability exists in the WebRTC implementation of Google Chrome on Windows. The flaw allows a malicious web page to trigger memory reads beyond the intended bounds of a buffer. When a crafted HTML page is rendered, an attacker could retrieve sensitive data that resides in the same process memory, potentially exposing credentials or other confidential information. The weakness is categorized as CWE‑125 and is rated high by Chromium security.

The vulnerability affects all Windows installations of Google Chrome running versions earlier than 149.0.7827.155. Any user who has not applied the latest update is exposed, regardless of other installed extensions or operating system patches.

With a CVSS score of 6.5, the vulnerability presents a moderate severity. The EPSS score is reported as less than 1 %, indicating a low probability of exploitation at the time of this analysis, and it is not listed in the CISA KEV catalog. Nonetheless, a remote attacker can exercise the flaw by delivering a malicious HTML document through the browser, typically via a phishing link or compromised website. The attack requires no local privileges and can be performed over the public internet.