A malicious file can trigger a Chrome codec routine that performs an out-of-bounds read, allowing an attacker to exfiltrate data from the browser process memory. The weakness is a memory safety violation (CWE-125) that can leak potentially sensitive information such as passwords, cookies, or other user data. The vulnerability is classified as a medium severity issue by Chromium's internal scoring.

Google Chrome on desktop platforms. All releases prior to 148.0.7778.96 are affected; the earliest patched version is 148.0.7778.96 released in the stable channel.

The CVSS score is 8.1, indicating a high severity issue, but the vulnerability provides a remote data leak path that requires the victim to open a malicious file. Since the exploit is read-only and does not execute code, the attack surface is limited to information disclosure, yet it remains impactful for credential theft or privacy violations. The EPSS score is less than 1%, indicating a very low but non-zero exploitation probability, and the vulnerability is not listed in CISA's KEV catalog.