A race condition exists in Chrome’s WebCodecs implementation that permits a remote attacker to read data from the browser’s process memory. An attacker can craft a malicious HTML page that exploits the timing flaw, allowing access to potentially sensitive information. This vulnerability falls under multiple concurrency weaknesses, as identified by CWE-362 and CWE-368, and is rated Medium in severity by Chromium’s own risk assessment.

All users of Google Chrome that run versions prior to 147.0.7727.55 are affected. The vulnerability is specific to the Chrome product from Google, and it does not extend to other browsers or products.

The CVSS base score of 5.3 places the flaw in the Medium severity range, and the EPSS score is below 1%, indicating a lower overall likelihood of exploitation. The vulnerability remains absent from the CISA KEV catalog. Exploitation requires a remote attacker to persuade a user to load a carefully crafted webpage, which can be achieved via phishing or malicious content hosting. An exploitation would allow the attacker to read privilege‑escalated memory contents, potentially leaking user secrets, browser tokens, or other confidential data.