A race condition exists in Chrome’s WebCodecs implementation that permits a remote attacker to read data from the browser’s process memory. An attacker can craft a malicious HTML page that exploits the timing flaw, allowing access to potentially sensitive information. This vulnerability falls under multiple concurrency weaknesses, as identified by CWE-362 and CWE-368, and is rated Medium in severity by Chromium’s own risk assessment.

All users of Google Chrome that run versions prior to 147.0.7727.55 are affected. The vulnerability is specific to the Chrome product from Google, and it does not extend to other browsers or products.

Exploitability requires a remote attacker to persuade a user to load a page that triggers the race; the exact method is not described in detail, but it is inferred that a malicious HTML page or similar content would be used. The attacker would typically need to convince the user to visit such a page—through phishing, malicious advertisements, or compromised sites—and the access would be gained via the timing flaw in WebCodecs. The low EPSS score (<1%) suggests a modest likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The CVSS base score of 7.5 places the flaw in the High severity range, indicating that successful exploitation could lead to a memory disclosure.