Google Chrome versions earlier than 145.0.7632.159 contain an inappropriate implementation in the WebAudio subsystem that permits a remote attacker to trigger an out of bounds memory read through a crafted HTML page. This flaw allows the attacker to read data beyond the intended buffer, potentially exposing private information or causing an application crash. The primary consequence is information disclosure and instability of the browser, with a high severity CVSS score of 8.8.

The vulnerability affects Google Chrome on all major operating systems, including Windows, macOS, and Linux. Any installation of Chrome prior to version 145.0.7632.159 is susceptible. The flaw is triggered by web content that a user can open in the browser, regardless of the underlying platform.

The CVSS score of 8.8 indicates a significant risk, while the EPSS score of less than 1% suggests that exploitation attempts are currently rare. Because the attack requires a user to visit a malicious page, it is a client‑side vulnerability that relies on social engineering or compromised sites. The issue is not listed in the CISA KEV catalog, so there are no publicly known widespread attacks, but its high severity warrants timely remediation.