The flaw is a use‑after‑free bug in the Google Lens module of Google Chrome that permits a remote attacker who has already compromised the renderer process to read data from the browser’s process memory. The attacker can craft an HTML page that triggers the vulnerable code, causing the renderer to access freed memory that may contain sensitive information. The weakness is classified as CWE‑416 and CWE‑825.

Versions of Google Chrome older than 148.0.7778.168 contain the vulnerable implementation of Google Lens. The issue is limited to the desktop Chrome stable channel and is not present in later releases.

The score of 6.5 on the CVSS base metric indicates moderate severity. Because exploitation requires a compromised renderer process, an attacker would typically need to deliver malicious content through a webpage that achieves that compromise; the EPSS score is unavailable, and the vulnerability is not present in the CISA KEV catalog, implying no publicly known exploits yet. The potential impact is limited to memory disclosure rather than code execution.