Executive brief
Google Chrome is a widely used web browser. A vulnerability in the browser's user interface component could allow a remote attacker to access sensitive information from the computer's memory. This attack requires the user to visit a specially crafted website and assumes the attacker has already gained a foothold in the browser's rendering process.
Technical details
This vulnerability is an out-of-bounds read (CWE-125) located in the UI component of Google Chrome. The flaw is reachable by a remote attacker who has already achieved code execution within a compromised renderer process (a common multi-stage attack scenario). By enticing a user to load a specially crafted HTML page, the attacker can trigger the memory read error to leak sensitive data from the browser's process memory. The issue was resolved in version 148.0.7778.168. While the NVD reports a CVSS of 5.3 (Medium), Chromium developers have classified the internal security severity as High.
Affected products
- Google Chrome prior to 148.0.7778.168
Timeline
- 2026-03-26: disclosed: Reported to Chromium by Google internal researchers
- 2026-05-12: patched: Fixed in Stable Channel Update 148.0.7778.167/168
- 2026-05-14: advisory: NVD publication date