A malicious file can trigger a Chrome codec routine that performs an out-of-bounds read, allowing an attacker to exfiltrate data from the browser process memory. The weakness is a memory safety violation (CWE-125) that can leak potentially sensitive information such as passwords, cookies, or other user data. The vulnerability is classified as a medium severity issue by Chromium's internal scoring.

Google Chrome on desktop platforms. All releases prior to 148.0.7778.96 are affected; the earliest patched version is 148.0.7778.96 released in the stable channel.

The CVSS score is 6.5, indicating a medium severity issue, but the vulnerability provides a remote data leak path that requires the victim to open a malicious file. Since the exploit is read-only and does not execute code, the attack surface is limited to information disclosure, yet it remains impactful for credential theft or privacy violations. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog.