This vulnerability arises from improper validation of untrusted input in the WebML feature of Google Chrome on Windows versions before 147.0.7727.55. An attacker can craft a malicious HTML page that, when visited by a user, may lead to disclosure of sensitive information from the browser's process memory. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality impact. The vulnerability is categorized under CWE-20 (Improper Input Validation).

Successful exploitation could result in unauthorized disclosure of sensitive information from Chrome's process memory. There is no impact on integrity or availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 147.0.7727.55 or later once available. Until then, exercise caution when visiting untrusted websites that may host crafted HTML content targeting this vulnerability.