This vulnerability involves a heap buffer overflow in the WebML feature of Google Chrome before version 147.0.7727.55. Exploitation requires a user to visit a maliciously crafted HTML page, which can lead to disclosure of sensitive information from the browser's process memory. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact. No integrity or availability impacts are reported. The vendor advisory is available but does not explicitly state if a patch has been released.

An attacker can remotely cause a heap buffer overflow in the WebML component, potentially leaking sensitive information from Chrome's process memory. This does not affect data integrity or availability. The impact is limited to confidentiality with a medium severity rating. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when visiting untrusted websites, as exploitation requires user interaction via a crafted HTML page.