This vulnerability involves an out of bounds read in the UI of Google Chrome before version 148.0.7778.168. Exploitation requires prior compromise of the renderer process, after which an attacker can craft an HTML page to read sensitive memory contents. The issue is recognized by Chromium with a high severity rating. No CVSS score or detailed remediation level is provided in the source data, but a vendor advisory for a stable channel update is available, indicating a fix was likely included in that update.

If exploited, an attacker with control over the renderer process can obtain sensitive information from Chrome's process memory. This could lead to information disclosure but requires prior compromise of the renderer process. There are no known exploits in the wild at this time.

A stable channel update for Google Chrome version 148.0.7778.168 addresses this vulnerability. Users should update to this version or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the update. Patch status is not explicitly confirmed in the advisory text provided, so users should verify the update details in the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html.