This vulnerability involves an out of bounds read in the SurfaceCapture functionality of Google Chrome before version 150.0.7871.47. An attacker can trigger this by delivering a specially crafted HTML page, causing the browser to read memory outside the intended bounds. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges and requires user interaction. The impact includes high confidentiality and availability impact but no integrity impact. The vulnerability is publicly disclosed and tracked as CVE-2026-14011.

Successful exploitation allows a remote attacker to read memory out of bounds, potentially exposing sensitive information and causing denial of service due to application instability or crash. The CVSS score of 8.1 reflects a high impact on confidentiality and availability. There are no reports of active exploitation in the wild at this time.

A fixed version is available in Google Chrome 150.0.7871.47. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory linked does not explicitly state the patch status, but the affected version list and description indicate that versions prior to 150.0.7871.47 are vulnerable and that updating to this version addresses the issue. Patch status is confirmed by the versioning information. No additional mitigations are specified by the vendor.