This vulnerability arises from an improper handling of CSS directives in Chrome prior to version 145.0.7632.159. A remote attacker can craft a malicious HTML page that, when opened in the browser, causes an out‑of‑bounds memory read. The consequence is exposure of sensitive data that resides in memory, potentially enabling an attacker to infer or exfiltrate confidential information. The weakness is classified as CWE‑284, indicating an authorization or access‑control flaw that permits unauthorized memory access.

Google Chrome versions older than 145.0.7632.159 on Windows, macOS, and Linux. The flaw is present in all desktop distributions regardless of operating system, as identified by the vendor’s product listings.

The CVSS score of 8.8 reflects high severity, but the EPSS score of less than 1% indicates that the probability of exploitation is currently low. The issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote and requires the victim to open a specifically crafted HTML document in Chrome. No authentication or privileged access is needed, making the threat relevant to any user who may inadvertently view malicious web content.