The vulnerability is an out‑of‑bounds read in the Media code path of Chromium. By loading a specially crafted HTML page in the vulnerable browser, a remote attacker can cause the renderer to read memory outside the intended buffer. This enables the attacker to exfiltrate arbitrary data from the process, potentially revealing sensitive information such as credentials, cryptographic keys, or other private data. The flaw is classified as CWE‑125 and carries high risk as indicated by the CVSS score of 8.8.

This issue affects Google Chrome browsers running any version prior to 145.0.7632.116 on all supported operating systems, including Windows, macOS, and Linux. The affected CPEs include cpe:2.3:a:google:chrome and the various OS CPEs show that the vulnerability is present across Chrome installations on all major platforms. Users of embedded or legacy versions of Chrome that have not yet received the 145.0.7632.116 security update remain exposed.

The CVSS score of 8.8 indicates a high severity, and the EPSS score of less than 1% suggests exploitation is currently rare, though not impossible. The vulnerability is not listed in the CISA KEV catalog at this time. The exploit requires delivery of a crafted HTML page that the victim browses, implying that a social engineering or drive‑by download vector could be used. Because the read occurs in the renderer process, privileges remain limited to the current user, so the damage is largely data disclosure rather than full system compromise.