The vulnerability originates in the Media module of Google Chrome’s renderer process. When a JPEG file is parsed, an out‑of‑bounds read can occur, allowing a remote attacker who has already compromised the renderer to read arbitrary process memory and potentially leak sensitive data. This is a classic memory safety failure classified as CWE‑125 and results in confidentiality impact rather than code execution or denial of service.

Google Chrome running on Linux and ChromeOS platforms is affected for all releases prior to 148.0.7778.168. The stable channel update released on 12 May 2026 removes the bug. Users on older versions of the browser are at risk if they open maliciously crafted JPEG files.

The CVSS score is 5.3, while the advisory labels the vulnerability as High severity. EPSS information is unavailable, so the current exploitation likelihood is unknown. The flaw is exploitable only if the attacker has already breached the renderer process; thus local privilege escalation or code execution in the renderer is a prerequisite. Because the vulnerability is not listed in the CISA KEV catalog and no widespread exploitation data exists, the attack vector is inferred to be a remote file‑based attack requiring pre‑existing renderer compromise.