An out‑of‑bounds read vulnerability was found within the Web Speech component of Google Chrome. The flaw allows a remote attacker to deliver a specially crafted web page that can trigger an out‑of‑bounds read and potentially escape the browser sandbox, providing an avenue for arbitrary code execution. The weakness is listed as CWE‑125, indicating unsafe memory handling.

The flaw affects Google Chrome on all platforms that support Web Speech, including Windows, macOS, and Linux distributions. Chrome versions prior to 146.0.7680.71 are vulnerable. No specific kernel or operating system versions are required for exploitation beyond the need for the Chrome browser.

Google Chrome carries a CVSS score of 9.6, classifying the vulnerability as Critical. The EPSS score of <1% shows a very low estimated probability of exploitation at the time of analysis, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a remote attacker sending a malicious HTML page to a user, who must view the page in an unprivileged Chrome instance. If exploited, the attacker could gain code execution privileges within the user's sandbox, threatening confidentiality, integrity, and potentially the entire system depending on the sandbox escape path.