An out-of-bounds read vulnerability exists in the Blink rendering engine of Google Chrome. A malicious web page can be crafted to trigger this issue, allowing a remote attacker to read memory beyond the intended bounds. The leaked memory could contain sensitive data, resulting in privacy loss. The weakness corresponds to CWE-125.

Google Chrome browsers that use the Blink engine are impacted. Vulnerable releases are any versions prior to 147.0.7727.55. Users running earlier versions should upgrade immediately, as no other vendors or products are listed as affected.

The Chromium severity is classified as Low, implying limited exploitability or impact, and EPSS is not available. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via a malicious web page delivered over the network. Although no public exploits are known, the absence of a public exploit does not diminish the potential for future attacks. Applying the vendor patch eliminates the risk.