An out-of-bounds read vulnerability exists in the codecs of Google Chrome versions before 150.0.7871.47. This vulnerability enables remote attackers to obtain potentially sensitive information from process memory by using a specially crafted HTML page. The issue is classified with a medium severity and a CVSS 3.1 base score of 6.5, indicating a moderate impact on confidentiality without affecting integrity or availability. The vendor advisory linked corresponds to a stable channel update announcement but does not explicitly state if this version includes a fix or if additional remediation is required.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information from the memory of the affected Chrome process. There is no indication that integrity or availability are impacted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later if the vendor confirms it contains a fix. Until confirmation, exercise caution when browsing untrusted content.