A flaw in the V8 JavaScript engine’s handling of object lifecycles allowed an attacker to trigger an out‑of‑bounds memory read from a crafted HTML page. The read can expose arbitrary memory contents, potentially leaking sensitive data or facilitating further exploitation. The vulnerability is categorized as a medium‑severity issue by Chromium’s internal scoring.

Google Chrome versions older than 148.0.7778.96 are affected. Any system running these versions of the browser is vulnerable when displaying malicious HTML content.

Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, there is currently no known widespread exploitation, although the CVSS score of 4.3 indicates that if exploited it could provide an attacker with data disclosure capabilities. The attack requires a malicious web page rendered by Chrome; once the page is loaded, the out‑of‑bounds read can occur without additional user interaction.