The vulnerability is an out‑of‑bounds read (CWE‑125) within the Fonts component of Google Chrome. A malicious HTML page can prompt the browser to read memory beyond the intended buffer, potentially revealing sensitive data such as secrets, credentials, or other confidential information. This flaw does not allow code execution or modification of system state, but it can compromise confidentiality in compromised environments.

Google Chrome versions prior to 148.0.7778.96 are affected. The disclosed update increases the minimum stable channel version to 148.0.7778.96, which mitigates the flaw.

The CVSS score of 4.3 indicates moderate severity, with no EPSS data available, indicating that the exploitation probability is not quantified. Because the flaw is triggered by a crafted web page viewed in the browser, an attacker would need to deliver and have the victim open the page, suggesting a typical web‑based attack vector. The lack of EPSS data means the exact likelihood of exploitation remains undetermined, but the moderate severity warrants attention.