A vulnerability in the Dawn rendering engine of Google Chrome allows a maliciously crafted HTML page to trigger an out‑of‑bounds read, letting an adversary read arbitrary memory contents. This flaw can potentially expose sensitive data stored in the process address space, resulting in confidentiality disclosure. The weakness is classified as CWE‑125.

Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability impacts all installations of Chrome that use the Dawn engine without the aforementioned patch.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploit activity. The CVSS score is 6.5, which corresponds to a Medium severity rating by Chromium, but an available exploit path exists via a remote attacker delivering a crafted HTML document. The likely attack vector is remote, originating from a malicious web page that the user visits.