Chrome for Windows prior to 147.0.7727.55 contains an insufficient input validation flaw in WebML. A remote attacker can embed malicious content in an otherwise harmless HTML page, causing the browser to read arbitrary memory while processing WebML data. This allows the attacker to obtain potentially sensitive information from the process memory, resulting in an informational disclosure that could expose confidential user data. The weakness is a classic input validation issue (CWE‑20).

The vulnerability affects Google Chrome running on Windows operating systems. Any installation of Chrome before version 147.0.7727.55 is susceptible, regardless of channel, as the patch is released for all stable releases. Users on newer versions are not impacted.

Overall risk is moderate. The flaw is exploitable remotely through a crafted web page without requiring user interaction beyond visiting the page. No authentication or elevated privileges are needed. While the EPSS score is not provided and the vulnerability is not listed in CISA’s KEV catalog, the medium severity rating and the ability to exfiltrate memory indicate a non-negligible threat if an attacker can supply malicious content to the victim’s browser.