The vulnerability is a heap buffer overflow in the WebRTC component of Google Chrome prior to revision 151.0.7922.72. A specially crafted HTML page can trigger an out‑of‑bounds memory read, allowing a remote attacker to access arbitrary data in Chrome’s heap. The flaw, which carries a CVSS score of 8.8, represents a serious reliability and confidentiality risk that could expose sensitive information such as cryptographic keys, credentials, or user data.

All installations of Google Chrome running a version older than 151.0.7922.72 are vulnerable. This includes the stable, beta, dev, and canary release channels across all supported operating systems.

The exploitation probability is low, with an EPSS score of less than 1 %. The flaw has not been catalogued as a Known Exploited Vulnerability by CISA. The most likely attack vector is remote, requiring the victim to visit a malicious web page that contains the crafted HTML payload. Successful exploitation depends on the nature of the data read, but it could potentially lead to information disclosure or, in some environments, a covert code execution path.