A flaw in the media component of Google Chrome on ChromeOS allowed an attacker who had previously compromised the renderer process to read arbitrary data from process memory through a specially crafted HTML page. The root cause is insufficient validation of untrusted input, which is a classic input validation weakness (CWE-20). As a result, an attacker could obtain potentially sensitive information, exposing data confidentiality without impacting availability or integrity of the system directly.

The vulnerability applies to Google Chrome running on ChromeOS. All versions prior to 148.0.7778.216 are impacted; newer releases include the fix.

The issue carries a moderate severity rating with a CVSS score of 5.3. EPSS indicates a lower exploitation probability (<1%) and it is not listed in the CISA KEV catalog. The likely attack scenario requires an attacker to first gain code execution or elevate privileges within the renderer process, after which a malicious webpage can trigger the memory disclosure. Because the vulnerability arises from unvalidated input, exploitation does not involve arbitrary code execution but still enables sensitive data leakage.