This vulnerability (CVE-2026-11140) affects Google Chrome versions before 149.0.7827.53 and is caused by an out-of-bounds read in the Chromecast component. An attacker who has already compromised the renderer process can exploit this flaw by delivering a specially crafted HTML page, which may lead to disclosure of sensitive information from process memory. The issue stems from insufficient validation of untrusted input, classified under CWE-20. The CVSS v3.1 base score is 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. There is no explicit vendor advisory stating a patch or remediation level, but the affected version is prior to 149.0.7827.53, implying that the fix is included in 149.0.7827.53 or later.

Successful exploitation allows a remote attacker with control over the renderer process to read sensitive information from process memory, potentially leading to information disclosure. The vulnerability does not affect integrity or availability. There are no known exploits in the wild at this time.

A fix is available in Google Chrome version 149.0.7827.53 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional vendor advisory details contradict this remediation. Since this is not a cloud service, patching the client software is required.