This vulnerability involves an out-of-bounds read in the Media component of Google Chrome on Linux and ChromeOS platforms before version 148.0.7778.168. An attacker with control over the renderer process can exploit this by supplying a specially crafted JPEG file, which may lead to disclosure of sensitive memory contents. The issue is recognized as high severity by Chromium security. The vendor advisory is referenced but does not explicitly confirm patch availability or remediation status in the provided data.

If exploited, an attacker with renderer process access could obtain sensitive information from process memory, potentially leading to information disclosure. This requires prior compromise of the renderer process, so the vulnerability is not directly exploitable remotely without such access. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html for current remediation guidance. Until official fixes are confirmed, users should ensure they apply updates promptly once available. No other specific mitigations are indicated in the advisory.