An out-of-bounds read exists in the WebCodecs component of Google Chrome, allowing a remote attacker to trigger memory reads beyond the intended buffer by delivering a specially crafted HTML page. The flaw, identified as CWE‑125, lets the attacker read arbitrary memory contents from the browser process, potentially exposing sensitive information. Google rates the security severity as medium, but the CVSS score of 8.8 indicates a high impact if successfully exploited.

Google Chrome versions prior to 146.0.7680.178 are affected. The issue applies across all operating systems supported by Chrome—macOS, Linux, and Windows—because the vulnerability resides in the browser engine rather than the underlying OS.

The CVSS score reflects high severity, yet the EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to open a malicious web page, providing remote access through the browser. The attacker obtains read‑only access to the victim’s process memory. While a public exploit has not been disclosed, the potential for information leakage warrants prompt remediation.