This vulnerability arises from an inappropriate implementation in the Extensions subsystem of Google Chrome versions before 149.0.7827.53. A remote attacker who has already compromised the renderer process can exploit this flaw by delivering a crafted HTML page that enables them to read sensitive information from process memory. The issue is classified under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality impact without affecting integrity or availability.

An attacker with control over the renderer process can extract sensitive information from Chrome's process memory, potentially leading to data leakage. The vulnerability does not impact the integrity or availability of the browser or system. There are no known exploits in the wild at this time.

The vendor advisory linked indicates a stable channel update for desktop Chrome but does not explicitly confirm the availability of a patch or remediation level. Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until a patch is confirmed, users should exercise caution with untrusted content and consider limiting exposure to potentially malicious HTML pages.