An out‑of‑bounds read in the WebAudio engine of Google Chrome on macOS allows a remote attacker to read data from the browser’s process memory when rendering a specially crafted HTML page. The vulnerability, identified as CWE‑125, provides an attacker the ability to obtain potentially sensitive information, leading to a medium‑severity information‑disclosure risk.

The flaw affects the Chrome web browser, specifically versions before 147.0.7727.55 running on macOS. Apple macOS is the operating system listed in the CPE, and the issue was reported for Google’s Chrome product on that platform.

The CVSS score of 5.3 indicates a moderate risk, and the EPSS metric of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivery of a malicious HTML page through the WebAudio API, making the attack a remote, within‑browser vector that can be launched from any website the victim visits. Because it is an information‑disclosure flaw, it primarily affects confidentiality rather than integrity or availability.