The vulnerability is a memory corruption bug in the Dawn component of Google Chrome. A specially crafted HTML page can trigger an out‑of‑bounds read that crosses sandbox boundaries, allowing a remote attacker to read memory that should normally be inaccessible. Chromium highlights this as a high‑severity issue, but the CVSS score is 6.5, indicating a medium‑to‑high impact. The flaw does not provide code execution, but it can leak sensitive data, leading to a confidentiality breach.

Affected versions are Google Chrome 156.0.8078.47 and earlier. The flaw exists in the Dawn graphics implementation used on desktop platforms. No other vendors or products are referenced.

The flaw scores a CVSS of 6.5, indicating a medium‑to‑high impact. The EPSS score of below 1% suggests a very low exploitation probability, and it is not listed in CISA’s KEV catalog. The attack vector is a remote web page; a malicious page can trigger the out‑of‑bounds read by exploiting memory corruption in the Dawn graphics implementation. While the vulnerability does not grant code execution, it can leak sandbox memory, potentially exposing sensitive data. The low EPSS and lack of known exploits mean the risk is moderate, but users should still apply the latest Chrome update promptly.