A flaw in the Media subsystem of Google Chrome on Windows allows an attacker who has already compromised the renderer process to read and exfiltrate information that should be protected by same‑origin policy. The attacker can craft a malicious HTML page that, once loaded in the compromised renderer, leaks browser memory contents between different origin contexts. This results in the disclosure of potentially sensitive user data and bypasses browser isolation mechanisms.

The vulnerability affects Chrome for Windows releases prior to version 148.0.7778.216. All users running any older build of Chrome on Windows should be aware that the renderer process is susceptible to this data‑leakage flaw.

Chromium rates the issue as low severity with a CVSS score of 3.1. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the renderer process to already be compromised, which typically demands an initial exploit or user action that grants attacker code execution in that process. Once this prerequisite is met, the data leakage can be achieved without further privileges and with relatively little effort, making it a significant threat to confidentiality for affected users.