The vulnerability arises from insufficient validation of untrusted input in the DataTransfer component of Google Chrome. An attacker can craft a web page that, once a user engages in specific UI gestures, causes Chrome to expose sensitive data from its process memory. The result is that an attacker may read confidential information, potentially including credentials or other secrets, from the victim’s memory space. The weakness is identified as CWE-20 (Improper Input Validation) and CWE-1286 (Insufficient Process Boundaries).

Google Chrome versions prior to 148.0.7778.168 are affected. The issue was present in all builds before this update within the stable channel.

Chromium classifies the severity as Critical, but the CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a remote attacker to host a specially crafted HTML page and convince a user to perform certain UI gestures. Once the gesture occurs, the flaw enables reading of the Chrome process memory, exposing potentially sensitive data. This risk is moderate and the likelihood cannot be quantified without the EPSS metric.