The vulnerability arises from insufficient validation of untrusted input in the Dawn rendering engine in Google Chrome on macOS. A remote attacker who has already compromised the renderer process can use a specially crafted HTML page to read data from other origins, which would normally be protected by the same‑origin policy. This leads to unauthorized disclosure of private or sensitive data, classified as a high‑severity flaw by Chromium.

Google Chrome for macOS versions prior to 149.0.7827.103 are affected. Any workstation or device running these versions could be exploited by an attacker who gains renderer privileges.

The flaw carries a high severity rating from Chromium, with a CVSS score of 3.1, indicating a low overall network severity, and is not yet listed in the CISA KEV catalog. Because EPSS information is unavailable, the exact likelihood of public exploitation is unknown, but the need to compromise the renderer isolation beforehand limits the attack surface. If an attacker succeeds in bypassing the renderer isolation, they can leak cross‑origin data through malicious webpages.