This vulnerability arises from inadequate validation of untrusted input within the DataTransfer functionality of Google Chrome versions before 148.0.7778.168. An attacker who convinces a user to perform certain UI gestures on a maliciously crafted HTML page may gain access to sensitive information residing in process memory. The issue is recognized as critical by Chromium security. The absence of a CVSS score and explicit remediation details in the input data limits the assessment of exploitability and patch status.

Successful exploitation could lead to unauthorized disclosure of sensitive information from Chrome's process memory. This could compromise user data confidentiality. There are no reports of active exploitation in the wild. The impact is considered critical based on the vendor's severity classification.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted web content and avoid engaging in unexpected UI gestures on unknown pages.