Google Chrome on macOS implements an Input Method Editor (IME) that, in versions prior to 151.0.7922.72, fails to protect sensitive data stored in the browser’s process memory. A crafted HTML page can trigger the flaw, allowing a remote attacker to read portions of that memory and potentially expose confidential information such as keystrokes or clipboard contents. The weakness is a classic information‑exposure flaw (CWE‑200) and does not involve code execution or privilege escalation.

The vulnerability affects Google Chrome running on macOS, specifically versions older than 151.0.7922.72. No other vendors or product lines are reported to be impacted, and later Chrome releases incorporate the fix.

The CVSS base score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of active exploitation at the time of analysis. The flaw is categorized as low severity by Chromium’s internal assessment and is not present in the CISA Known Exploited Vulnerabilities catalog, implying that it has not yet been widely leveraged in the wild. The attack vector is inferred to be remote, requiring an attacker to host a malicious web page that can be accessed by a victim using Chrome.