The vulnerability is an out‑of‑bounds read in the Dawn rendering engine of Google Chrome. When a specially crafted HTML page is parsed, the engine accesses memory beyond the intended buffer, which can leak sensitive data or corrupt execution flow. This bug is classified as CWE‑125 and is capable of allowing a remote attacker to escape the browser’s sandbox and execute code with elevated privileges, potentially compromising the host operating system.

Google Chrome for desktop is affected. Any Chrome release prior to version 150.0.7871.46 is vulnerable; users running older stable channel builds are at risk.

The flaw requires an attacker to deliver a crafted HTML page to the vulnerable browser, a plausible scenario for drive‑by attacks or malicious web sites. The CVSS score of 9.6 reflects the high impact and complete remote attack scope. The EPSS score of less than 1 % indicates a low probability of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Although Chromium internally rates the issue as low severity, the potential for sandbox escape means that any successful exploitation would grant the attacker significant control over the host system.