The vulnerability is a type confusion in the V8 JavaScript engine in Google Chrome before version 148.0.7778.168. A malicious website can deliver a crafted HTML page that causes the engine to read arbitrary process memory, enabling an attacker to gather potentially sensitive data such as cookies, authentication tokens, or other in‑memory secrets. The flaw is not a code execution flaw but allows data leakage from the browser process. The likely attack vector is a web page served over HTTP or HTTPS that a user visits; it is inferred from the need for a crafted HTML page to trigger the misuse of V8’s type system.

Affected products are Google Chrome running on desktop platforms; any installation of Chrome with a version older than 148.0.7778.168 is vulnerable. The issue was fixed in the stable channel update released in May 2026.

The CVSS score of 6.5 classifies the flaw as medium severity, and the EPSS score remains unavailable. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. However, because the flaw can be triggered by a simple crafted HTML page, the attack is remote via the browser, and any user visiting a malicious site with the attack payload can receive sensitive data. The fix is in the latest Chrome release, so updating mitigates the problem.