An out‑of‑bounds read in Chrome’s renderer process allows a remote attacker who has already compromised that process to extract potentially sensitive data from process memory through a crafted HTML page. The weakness is a classic array bounds overflow (CWE‑125), which can leak confidential information without altering program state. The victim is limited to the data stored in the renderer’s address space, but this can include session tokens, cookies, or other user data.

Google Chrome prior to version 148.0.7778.168 is affected. Chrome users running the stable channel or earlier builds may be vulnerable.

The EPSS score is unavailable, so the likelihood of exploitation cannot be quantified from publicly available data. The CVSS score is 5.3, indicating medium severity. The vulnerability is listed as high on the Chromium security severity scale and is not included in the CISA KEV catalog. Because an attacker must first compromise the renderer process before exploiting the memory read, the attack vector is inferred to require a local or remote compromise of Chrome’s rendering component, typically by delivering malicious web content or exploiting a separate vulnerability. Risk assessment must therefore consider a threat actor capable of controlling or injecting code into Chrome’s renderer activity.