This vulnerability involves an out-of-bounds read in the codecs used by Google Chrome before version 148.0.7778.96. An attacker can exploit this by delivering a malicious file that triggers the out-of-bounds read, potentially leaking sensitive information from the browser's process memory. The CVSS score of 8.1 indicates a high impact on confidentiality and integrity, with no impact on availability. The vulnerability requires user interaction (UI:R) but no privileges or complex attack conditions. The vendor advisory is available but does not specify patch or remediation details.

Successful exploitation could lead to unauthorized disclosure of sensitive information from Chrome's process memory. This impacts confidentiality and integrity but does not affect system availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when opening untrusted files in Chrome. No vendor-stated mitigations or workarounds are currently documented.