A flaw in Google's Dawn rendering engine on Windows allows insufficient validation of untrusted input. If a remote attacker can compromise the renderer process, a crafted HTML page can exfiltrate cross‑origin data. The weakness is classified as CWE‑20 (Improper Input Validation). Attackers could obtain confidential data from other origins loaded in the same browsing context, potentially leading to privacy breaches. The vulnerability does not grant full code execution but enables sensitive information disclosure.

Versions of Google Chrome running on Windows before 149.0.7827.53 are affected. The issue exists in the Chrome stable channel and any Windows installation that has not yet received the update.

The CVSS score is unspecified, but the Chromium security severity is listed as High. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation. However, exploitation requires an attacker who has already compromised the renderer process, which could be achieved through other vulnerabilities or social engineering. Once the renderer is compromised, the attacker can perform the cross‑origin data exfiltration with relative ease.