A flaw in Google Chrome’s spellcheck system allows a remote attacker who has already compromised the renderer process to read sensitive data from that process’s memory through a specially crafted HTML page. Based on the provided information, the attack vector is inferred to involve delivering a maliciously crafted HTML page to the victim’s browser.

All releases of Google Chrome prior to version 150.0.7871.47 are affected. No other vendors or products known to be impacted, as the issue resides solely in Google’s Chromium‑based browser implementation.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% shows a very low probability of exploitation. However, the flaw requires a prior compromise of the renderer process, which could occur through separate vulnerabilities. Based on the provided information, the attack vector is inferred to involve a maliciously crafted HTML page once the renderer is compromised; the attacker can read memory contents via this page, potentially leaking user information. The vulnerability is not listed in CISA’s KEV catalog, so the overall risk remains moderate, but patching is recommended to eliminate the leakage path.