This vulnerability involves an out-of-bounds read in the Extensions component of Google Chrome on Linux platforms before version 149.0.7827.53. An attacker leveraging this flaw must first persuade a user to install a crafted malicious extension, which then can read beyond allocated heap buffers to potentially access sensitive process memory information. The issue is recognized by Chromium security with a medium severity rating. No CVSS score or detailed remediation information is provided, though a vendor advisory link to a stable channel update is available.

An attacker who successfully convinces a user to install a malicious Chrome extension on Linux can exploit this vulnerability to read sensitive information from process memory. This could lead to information disclosure but does not indicate direct code execution or system compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update Chrome to version 149.0.7827.53 or later once available. Until then, avoid installing untrusted or suspicious extensions.