A heap buffer overflow in the WebML component of Google Chrome allows a remote attacker to read memory contents when a specially crafted HTML page is loaded. The vulnerability could expose sensitive information stored in the browser process, leading to confidentiality compromise. It is classified as a high severity issue by Chromium security, reflecting the seriousness of the potential data exposure.

The flaw affects Google Chrome on all supported operating systems before the 147.0.7727.55 release. This includes Windows, macOS, Linux, and potentially Chrome for embedded devices that use the same code base. Users on earlier browser versions should upgrade to any release newer than 147.0.7727.55.

The CVSS score is 4.3, indicating a moderate risk level, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, further indicating limited known exploitation. The likely attack vector is a remote attacker delivering a malicious HTML page that triggers the overflow via WebML. No local privileges or additional access are required, but an active network connection to the user’s browser is necessary.