An out‑of‑bounds memory read was discovered in the WebAudio implementation of Google Chrome. An attacker can exploit this flaw by serving a specially crafted web page to a user browsing with Chrome on macOS, causing the browser process to read data beyond the bounds of a buffer. This leak can expose potentially sensitive information from the process memory, compromising confidentiality. The weakness is formally classified as CWE‑125, buffer over-read.

The vulnerability affects Google Chrome running on macOS versions prior to 147.0.7727.55. Any install of Chrome on a Mac before this release is potentially vulnerable. Updating to 147.0.7727.55 or later removes the flaw.

The issue carries a medium severity designation by Chromium because the attacker must be able to run an HTML page in the user’s browser. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. However, because the attack vector relies on normal web browsing, the risk to environments where users visit untrusted sites is significant. Installing the fixed release immediately mitigates the flaw.