CVE-2026-10998 is an out of bounds read vulnerability in the Media component of Google Chrome. It affects versions before 149.0.7827.53 and can be triggered by an attacker on the local network segment sending crafted network traffic. The vulnerability allows reading memory outside intended bounds, which may lead to information disclosure. The CVSS 3.1 vector indicates low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official remediation level or patch confirmation is explicitly stated in the provided advisory, though the fixed version is identified as 149.0.7827.53.

An attacker on the local network segment can exploit this vulnerability to perform an out of bounds memory read, potentially leading to limited information disclosure. There is no indication of integrity or availability impact. The CVSS score of 4 and medium severity reflect this limited confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. The fixed version is identified as 149.0.7827.53, so updating to this version or later is recommended once confirmed.