Technical impact
The Dawn rendering engine in Google Chrome contains an implementation flaw that permits a remote attacker to trigger out-of-bounds memory access by serving a specially crafted HTML page. This flaw can lead to memory corruption, which may be exploitable for arbitrary code execution or a denial of service, depending on the execution context. The Chromium security team has rated the issue as Medium severity, indicating that while exploitation is possible, it is not guaranteed to achieve high-impact results without additional conditions.
Affected Systems
Google Chrome versions earlier than 149.0.7827.53 are affected. No other Chrome versions are known to be impacted. The vulnerability resides specifically in the Dawn component of the browser.
Risk and Exploitability
The vulnerability can be leveraged from the internet by delivering the malicious HTML page to a user’s browser. The attack vector is remote and requires the victim to open or load the crafted page. No input from the CVE indicates that the flaw requires privileged access or local compromise. The CVSS score of 8.8 indicates a high severity, and the EPSS score is < 1%, suggesting a comparatively lower likelihood of widespread exploitation at present. The flaw is not listed in CISA's KEV, indicating it has not been identified as a known exploited vulnerability. The Chromium security severity of Medium reflects a moderate risk profile, with the potential to lead to memory corruption but with uncertain exploitation success.
Debian DSA