The vulnerability arises from an improper cast in the Dawn rendering engine, leading to an out‑of‑bounds read (CWE‑125) and type misuse causing undefined behavior (CWE‑843). This flaw allows a remote attacker to craft an HTML page that, when opened in Chrome, grants arbitrary code execution inside the browser’s sandbox. The attack can compromise the confidentiality, integrity, or availability of the sandboxed process, and potentially elevate to full system compromise if the sandbox is bypassed.

This issue affects Google Chrome browsers version 149.0.7827.x and earlier on all supported operating systems, including Windows, macOS, and Linux. The vulnerability does not exist in newer releases of Chrome that include the patch contained in version 149.0.7827.53.

The CVSS score is 8.8, indicating high severity. The EPSS score is <1%, indicating low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. An attacker would need to trick a user into opening a malicious HTML page in the vulnerable version of Chrome; thus the attack vector is likely web‑based. Once triggered, arbitrary code executes within the sandboxed renderer process, which could facilitate further exploitation by leveraging the out‑of‑bounds read (CWE‑125) and type confusion (CWE‑843) in Dawn.